CVE-2026-92000

Published: Sep 15, 2026Modified: Sep 24, 2026Deferred

8.7

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring zero size to exhaust memory and cause denial of service.

Related CWEs

Improper Handling of Highly Compressed Data (Data Amplification)

The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

References (6)

https://github.com/cthackers/adm-zip

Source: disclosure@vulncheck.com

https://github.com/cthackers/adm-zip/blob/v0.6.0/methods/inflater.js

Source: disclosure@vulncheck.com

https://github.com/cthackers/adm-zip/commit/491600683dacb6cb9fe0718a0eeb9cb5eb49afa6

Source: disclosure@vulncheck.com

https://github.com/cthackers/adm-zip/commit/8bc411184de1b5ca28138c53074fb61119994dde

Source: disclosure@vulncheck.com

https://github.com/cthackers/adm-zip/security/advisories/GHSA-rcw4-f5rp-g42v

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/adm-zip-0.5.14-through-0.6.0-denial-of-service-via-zero-declared-uncompressed-size

Source: disclosure@vulncheck.com

Timeline

No history available yet.