CVE-2026-117556 Details
Description
zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in read_preface() in src/lib/header.c that passes the total header length instead of remaining bytes to compint parsing functions. Attackers can supply a crafted .zck file whose header ends inside a compressed integer, causing reads past the heap header buffer and crashing the application.
A heap out-of-bounds read vulnerability has been identified in zchunk versions prior to 1.5.5. The issue arises in the read_preface() function within src/lib/header.c, where the total header length is incorrectly passed to the compressed-integer parsing functions instead of the remaining bytes. This flaw allows attackers to craft a .zck file that exploits the header parsing, leading to reads beyond the allocated heap buffer and causing the application to crash.
Users can upgrade to zchunk version 1.5.5 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/zchunk/zchunk | [email protected] | Vendor |
| https://github.com/zchunk/zchunk/blob/1.5.4/src/lib/header.c#L167 | [email protected] | Source CodeVendor |
| https://github.com/zchunk/zchunk/commit/02b371a64bf98245df97315d07c684a0ca5ea1df | [email protected] | Source CodeVendor |
| https://github.com/zchunk/zchunk/issues/119 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/zchunk/zchunk/releases/tag/1.5.5 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/zchunk-before-1.5.5-heap-out-of-bounds-read-via-read-preface | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| zchunk | >= 0, < 1.5.5 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |