zchunk CVE-2026-117556

The target application must parse an attacker-supplied, crafted .zck file whose header is truncated so that it ends inside a compressed integer; this triggers read_preface() to pass the total header length instead of the remaining byte count to compint_to_size/compint_to_int, over-reading the heap header buffer. No authentication is required (PR:N), and no special non-default configuration is named - any build before 1.5.5 that processes untrusted .zck input is affected. Limiting factors: the victim application must actually ingest the malicious file (UI:P, passive - e.g. automatic metadata fetch), and the only confirmed outcome is a crash (VA:L) with no code execution, data disclosure, or integrity impact, so realistic risk is denial of service against the parsing process.

Signals are consistent and point to a moderate, availability-only issue rather than a top-priority emergency. The CVSS 4.0 base score is 5.3 (medium) with vector AV:N/AC:L/AT:N/PR:N/UI:P and impact confined to VA:L - a crash - while VC:N and VI:N confirm no confidentiality or integrity impact despite the CWE-125 out-of-bounds read; the sources state the over-read only crashes the application and do not describe any leak of data back to the attacker. The vuln.today decision label is 'this_month', not act_now or emergency, matching a DoS-class defect with an available patch. This is NOT in CISA KEV, so there is no confirmed active exploitation, and no EPSS score was supplied, so widespread-exploitation probability cannot be quantified from the input - this gap should be noted rather than assumed low or high. No confirmed working public exploit is provided; the fix commit ships a regression test that only detects the over-read under a memory sanitizer (valgrind/ASan). Net assessment: a real but bounded issue - remote, unauthenticated triggering is plausible because .zck files are typically fetched automatically as repository metadata, but the worst realistic outcome is a process crash, so treat it as routine patching within the normal cycle, not an urgent drop-everything fix.

An attacker crafts a malicious .zck file whose header is truncated so it ends in the middle of a compressed integer and supplies it to a victim (for example as poisoned repository metadata fetched by a zchunk-based tool). When the victim's application calls read_preface() in src/lib/header.c, the total header length rather than the remaining byte count is passed to the compint parser, so parsing reads past the end of the heap header buffer and the process crashes. No confirmed working public exploit is provided; the patch includes a sanitizer-only regression test demonstrating the over-read, consistent with the AV:N/AC:L/UI:P vector.