Read the docs
TI-2026-75056 Aliases CVE-2026-111274GHSA-rj75-52m6-37p5

Heap out-of-bounds read in unarr ZIP extra field parsing

Priority MEDIUM 63CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

The unarr package by selmf through 1.1.1 is affected. An incorrect ZIP64 extra field length check in zip_parse_extra_fields causes a heap out-of-bounds read (CWE-125). If a user opens a crafted ZIP archive with a truncated ZIP64 record, the process reads past a heap buffer and crashes. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

unarr through 1.1.1 contains a heap-based out-of-bounds read in zip_parse_extra_fields() in zip/parse-zip.c due to an incorrect ZIP64 extra field length check. Attackers can supply a crafted ZIP archive with 0xFFFFFFFF sentinel values and a truncated ZIP64 record to read past the heap buffer and crash the process.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00196 9th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
selmfunarrup to 1.1.1—No fix listedCNA
  • unarr Vendorselmf Affected up to 1.1.1 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for unarr.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-111274
  2. 2026-10-16 Priority changed: MEDIUM → LOW
  3. 2026-10-23 CISA SSVC decision points changed
  4. 2026-10-23 Priority changed: LOW → MEDIUM
  5. 2026-11-02 2 new references · CNA
  6. 2026-11-02 Alias added: GHSA-rj75-52m6-37p5

References

Exploit 1

Patch 1

Advisory 1

  • TI-2026-75055 Off-by-one heap buffer overflow in unarr TAR name parsing CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences