EUVD-2026-102529
GHSA-rj75-52m6-37p5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft ZIP with 0xFFFFFFFF sentinel and truncated ZIP64 record
-
ExploitVictim opens archive in unarr-based application
-
ExecutionTrigger OOB read in zip_parse_extra_fields()
-
ImpactCrash process (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a host application that links unarr (<=1.1.1) and invokes its ZIP parser on attacker-controlled input. The attacker must supply a crafted ZIP archive whose central-directory/local entry contains 0xFFFFFFFF ZIP64 sentinel values together with a truncated ZIP64 extra-field record that defeats the incorrect length check in zip_parse_extra_fields(). Exploitation is LIMITED by: a local attack vector (the malicious file must reach the victim), required passive user interaction (UI:P - the archive must be opened/processed by the vulnerable application), and an impact ceiling of a crash only - no confidentiality or integrity compromise and no code execution are indicated. |
| Impact | This is a moderate-severity, low-priority issue rather than an urgent one. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, score 6.8) describes a locally-delivered crafted-file attack requiring passive user interaction, with the only impact being availability (VA:H) - a process crash - and explicitly no confidentiality (VC:N) or integrity (VI:N) impact. This aligns with CWE-125 (out-of-bounds read) and the description, which states the result is a crash, not data theft or code execution. No CISA KEV listing, no EPSS score was provided, and no explicit public-exploit flag is set, so exploitation status is 'no public exploit identified at time of analysis' - though a detailed third-party technical writeup (hackmd) and the VulnCheck advisory document the exact vulnerable code path. Signals are internally consistent: a DoS-only, user-interaction-gated, local-vector bug in a niche library does not warrant emergency patching. Note one tension: the 'Information Disclosure' tag conflicts with the CVSS VC:N and the description's crash-only outcome - the practical impact is denial of service, not disclosure. |
| Exploit ScenarioDerived | An attacker crafts a malicious ZIP archive containing 0xFFFFFFFF ZIP64 sentinel values with a truncated ZIP64 extra-field record and delivers it to a victim who opens or processes it with an application built on unarr (<=1.1.1). When the application parses the extra fields, the incorrect length check causes a heap out-of-bounds read that crashes the process (denial of service). A detailed technical writeup of the flaw is publicly available, but no weaponized exploit flag is indicated in the source data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Heap-based out-of-bounds read in unarr through 1.1.1 lets a crafted ZIP archive crash any host application that links the library and passes it attacker-controlled input. The defect is in zip_parse_extra_fields() in zip/parse-zip.c, where an incorrect length check on the ZIP64 extra-field record allows reads past the end of a heap buffer when an archive supplies 0xFFFFFFFF sentinel values together with a truncated ZIP64 record; the demonstrated impact ceiling is a denial of service (process crash), with no confidentiality or integrity compromise and no code execution indicated. Exploitation requires the malicious archive to reach the victim and be opened or processed by the vulnerable application (local attack vector, passive user interaction, no privileges required), and no public exploit identified at time of analysis - this is a moderate-severity, low-priority issue rather than an urgent one.
RemediationAI
Patch status: No vendor-released patch identified at time of analysis, and no fixed version is named in the available references; the vulnerable code is publicly visible at https://github.com/selmf/unarr (zip/parse-zip.c lines 48-72), so the durable fix is to correct that length check so the ZIP64 extra-field data size is validated against the remaining buffer before the 8-byte members are read, then rebuild every downstream application that statically embeds unarr. Until an upstream fix is released, compensating controls must be applied at the integration boundary: reject or quarantine archives that contain 0xFFFFFFFF sentinel values in size/offset fields paired with a truncated or inconsistent ZIP64 extra field (0x0001) before handing input to unarr - the trade-off is that legitimate ZIP64 archives over 4 GB or with very large entry counts may also be blocked, so this filter should be applied only to untrusted input or tuned carefully. Isolate the parsing work in a low-privilege, memory-limited child process, container, or systemd service so that the out-of-bounds read and resulting crash cannot take down the host application or expose adjacent memory in a long-lived process (trade-off: added process-management complexity and per-archive startup cost). In environments where archive handling is not business-critical, disable automatic opening of ZIP attachments/downloads and require explicit user action so the UI:P precondition is harder to satisfy. Monitor the upstream repository and the referenced advisories (https://www.vulncheck.com/advisories/unarr-through-1.1.1-heap-out-of-bounds-read-via-zip-parse-extra-fields) for a patched release, and re-test any locally applied length-check patch against both normal and ZIP64 archives, since an overly strict check can break legitimate large-archive support. There is no configuration-only switch inside unarr 1.1.1 that turns this parser off.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
unarr is a small C library for reading RAR and ZIP archives, embedded in downstream document/comic viewers and similar applications; the affected component is the ZIP central-directory and local-header parser (zip/parse-zip.c, extra-field handling at upstream lines 48-72). The root cause class is CWE-125 (out-of-bounds read): ZIP extra fields are a length-prefixed chain of (header ID, data size, data) records, and header ID 0x0001 carries the ZIP64 extension used to express 64-bit sizes and offsets. When a 32-bit size or offset field in the standard header holds the 0xFFFFFFFF sentinel, parsers are expected to substitute the corresponding 8-byte value from the ZIP64 extra field. In unarr through 1.1.1 the length check applied to that ZIP64 record is wrong, so a truncated extra field (data size advertised as longer than the bytes actually present, or a record that ends before all expected 8-byte members) is not rejected; the parser then walks past the heap allocation that held the extra-field data. The result is an out-of-bounds read that typically manifests as a crash, and only that - the CNA's CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) and the independent CVSS 3.1 assessment (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) both cap impact at high availability loss, so confidentiality leakage is theoretical rather than assessed. Technical details of the parsing flaw are published in the linked HackMD writeup, and the vulnerable source is publicly visible in the upstream GitHub repository, which lowers the effort needed to reproduce a crashing archive.
Know when Unarr gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Crafted file must be opened by the victim (AV:L, UI:R), needs no privileges (PR:N), and causes only a crash, so C:N/I:N/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
unarr through 1.1.1 contains a heap-based out-of-bounds read in zip_parse_extra_fields() in zip/parse-zip.c due to an incorrect ZIP64 extra field length check. Attackers can supply a crafted ZIP archive with 0xFFFFFFFF sentinel values and a truncated ZIP64 record to read past the heap buffer and crash the process.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB