fflate EUVD-2026-117202

Exploitation requires that the target application call fflate's unzipSync (in esm/index.mjs) on ZIP archive data that an attacker can control or supply, in fflate versions up to and including 0.8.3. The trigger mechanism is not described in the available sources beyond 'manipulation' of the unzip function on crafted input. Limiting factors: the flaw is only reachable if the application decompresses untrusted/attacker-influenced ZIP data with unzipSync - applications that only unzip trusted, internally-produced archives are not exposed; no authentication or user interaction is needed per the CVSS 4.0 vector, but the real impact is bounded to Low confidentiality/integrity/availability, consistent with a parsing/DoS fault rather than remote code execution.

Signals conflict and the overall quality of the source data is weak. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with E:P yields a 6.9 (Medium) score and implies trivial remote, unauthenticated triggering, but all three impact metrics are only Low (VC:L/VI:L/VA:L) with no subsequent-system impact, so even taken at face value this is not a high-impact flaw. The vuln.today decision label is 'this_month', i.e. routine prioritization rather than act_now/emergency. This is NOT in CISA KEV and there is no EPSS value provided, so widespread or confirmed exploitation cannot be asserted. The only 'exploit' reference points to an unrelated GitHub issue (ictrun/java/issues/9) and is a PoC reference not verified as working exploit code. A substantive caveat: the record claims 'memory corruption' / buffer overflow (CWE-119) in fflate, which is a pure-JavaScript compression library - classic memory corruption does not occur in standard JS engines, so the described impact is most plausibly a crash, unhandled exception, or out-of-range read on malformed ZIP input rather than true memory corruption; this mislabeling should be verified with the maintainer before treating it as a memory-safety bug. The report also originates solely from VulDB with no vendor acknowledgement (the vendor did not respond), lowering confidence further. Net: treat as a low-to-medium real-world priority - likely a denial-of-service/robustness issue in ZIP parsing, not a confirmed remote code execution risk.

An application uses fflate's unzipSync to decompress ZIP data that originates from an untrusted source (file upload, fetched archive, or user-supplied blob); an attacker submits a crafted ZIP archive that triggers the fault in the unzip routine. A public PoC reference exists but is not verified as working exploit code, and given fflate is pure JavaScript the realistic outcome is a crash/unhandled exception (denial of service) rather than confirmed arbitrary code execution. Per the CVSS 4.0 vector the attack is network-reachable, low-complexity, and needs no privileges or user interaction, but only if the application feeds attacker-controlled archives into unzipSync.