CVE-2026-68924 MobSF CVE debrief

Who should care

Authenticated users with upload access to MobSF, system administrators, and security teams responsible for monitoring and maintaining MobSF installations. This includes operators managing MobSF deployments, platform administrators with access to the system, vulnerability management teams, and security teams responsible for reviewing and implementing security advisories.

Why it matters

CVE-2026-68924 is a medium-severity vulnerability in MobSF that allows authenticated users to potentially exhaust disk space by uploading crafted ZIP or APK files. Defenders should verify and limit input archive sizes, upgrade to version 4.5.1 or later, and monitor disk space usage and scan logs.

• Potential disk space exhaustion and prevention of further scans
• Need to verify and limit input archive sizes for authenticated users with upload access
• Requirement to upgrade to MobSF version 4.5.1 or later

Technical summary

Prior to 4.5.1, the unzip function in mobsf/StaticAnalyzer/views/common/shared_func.py logs that an archive member exceeding ZIP_MAX_UNCOMPRESSED_FILE_SIZE is being skipped but does not continue to the next member, so an authenticated user can upload a crafted ZIP or APK whose oversized member is extracted to disk when the aggregate ZIP_MAX_UNCOMPRESSED_TOTAL_SIZE limit has not yet been reached, potentially exhausting disk space and preventing further scans.

Defensive priority

Authenticated users with upload access should verify and limit input archive sizes to prevent potential disk exhaustion.

Recommended defensive actions

• Verify and limit input archive sizes for authenticated users with upload access
• Upgrade to MobSF version 4.5.1 or later
• Monitor disk space usage and scan logs for potential issues
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The issue is fixed in version 4.5.1 of MobSF. An authenticated user can upload a crafted ZIP or APK whose oversized member is extracted to disk when the aggregate ZIP_MAX_UNCOMPRESSED_TOTAL_SIZE limit has not yet been reached, potentially exhausting disk space and preventing further scans.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.