CVE-2026-111274 Details
Description
unarr through 1.1.1 contains a heap-based out-of-bounds read in zip_parse_extra_fields() in zip/parse-zip.c due to an incorrect ZIP64 extra field length check. Attackers can supply a crafted ZIP archive with 0xFFFFFFFF sentinel values and a truncated ZIP64 record to read past the heap buffer and crash the process.
A heap-based out-of-bounds read vulnerability has been identified in the unarr library, specifically in versions through 1.1.1. The issue arises in the ZIP parsing component, within the 'zip_parse_extra_fields' function of 'zip/parse-zip.c'. The vulnerability is caused by an incorrect length check for ZIP64 extra fields, allowing attackers to craft ZIP archives that exploit this flaw. By inserting sentinel values and truncated ZIP64 records, attackers can manipulate the parser to read beyond allocated memory buffers, potentially leading to crashes or memory corruption.
Users can upgrade to unarr version 1.1.1 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| selmf unarr | <= 1.1.1 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | [email protected] |
| Oct 23, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |