CVE-2026-115909: zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction

October 29, 2026

The symbolic-link branch of ZipArchive::extract_internal() allocates a buffer using an attacker-declared size before reading any entry data. A 112-byte archive terminates the extracting process with SIGABRT through this infallible allocation.

References

github.com/advisories/GHSA-q7v9-x93c-xqv3
github.com/zip-rs/zip2/commit/a543a1fc8f3f3eef36f27bb137230295284cdb98
github.com/zip-rs/zip2/pull/984
github.com/zip-rs/zip2/releases/tag/v9.0.0
github.com/zip-rs/zip2/security/advisories/GHSA-q7v9-x93c-xqv3
nvd.nist.gov/vuln/detail/CVE-2026-115909

Code Behaviors & Features

Detect and mitigate CVE-2026-115909 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →