Log in Start free

Vulnerability · Published Oct 26, 2026 · Assigned by GitHub_M

CVE-2026-115905zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

Critical 10.0

In plain English

A critical-severity improper input validation in zip2 from zip-rs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 4.0)10.0Critical
Exploit odds (30 days)0.3%top 74.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC

Official description

zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in src/read/stream.rs. A crafted archive can therefore appear benign to a component that inspects the central directory but cause a streaming extractor to write a different attacker-selected path and content, potentially overwriting files used by a downstream service. This issue is fixed in version 9.0.5.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12rust-zipno fix listedDEBIAN-CVE-2026-115905
Debian:13rust-zipno fix listedDEBIAN-CVE-2026-115905
Debian:14rust-zipno fix listedDEBIAN-CVE-2026-115905
Ubuntu:22.04:LTSrust-zipno fix listedUBUNTU-CVE-2026-115905
Ubuntu:24.04:LTSrust-zipno fix listedUBUNTU-CVE-2026-115905
Ubuntu:26.04:LTSrust-zipno fix listedUBUNTU-CVE-2026-115905
Ubuntu:26.10rust-zipno fix listedUBUNTU-CVE-2026-115905

Affected products (as reported)

VendorProductVersions
zip-rs zip2 < 9.0.5

Weakness: CWE-20, CWE-436 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L

References