CVE-2026-115907 zip-rs CVE debrief

Who should care

Defenders responsible for maintaining and securing applications that use the zip library, particularly those that enable `legacy-zip` and use `ZipArchive::extract()`, should assess exposure and prioritize verification and potential upgrades.

Why it matters

Defenders should care about CVE-2026-115907 because it can cause a denial of service in applications that use the vulnerable zip library, potentially disrupting functionality and requiring verification and upgrades.

• Denial of service through process termination
• Potential disruption to application functionality
• Need for verification of vulnerable zip versions in inventory
• Prioritization of upgrades to version 9.0.0 or later

Technical summary

The vulnerability is located in the Shrink decoder of the zip library, specifically in the `ShrinkDecoder::read()` function. An attacker-controlled ZIP64 uncompressed size can trigger a `capacity overflow` panic, potentially terminating the affected process. The vulnerable legacy codecs are compiled when the `legacy-zip` Cargo feature is enabled. `self.uncompressed_size` is populated from ZIP metadata. For ZIP64 entries, an attacker can set it to a 64-bit value independently. This issue can be mitigated by upgrading to version 9.0.0 or later of the zip library.

Defensive priority

Defenders should prioritize verifying the presence of vulnerable zip versions in their inventory and assess exposure through applications that enable `legacy-zip` and use `ZipArchive::extract()`.

Recommended defensive actions

• Verify the presence of vulnerable zip versions in inventory
• Assess exposure through applications that enable `legacy-zip` and use `ZipArchive::extract()`
• Consider upgrading to version 9.0.0 or later of the zip library
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The source corpus provides details on the vulnerability in the zip library, specifically in the Shrink decoder, and mentions that the vulnerable legacy codecs are compiled when the `legacy-zip` Cargo feature is enabled.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.