The adm-zip package's fix for CVE-2026-39244 limits decompression output size based on the declared uncompressed size in the ZIP entry header. However, if an attacker sets this declared size to zero, the limit is not applied, and zlib's internal default maximum output size (several GB) is used instead. This allows a small compressed payload to decompress into a very large buffer, causing resource exhaustion. The vulnerability affects adm-zip version 0.6.0 and can be triggered by crafting a ZIP archive with a zero declared uncompressed size header while maintaining a valid CRC. The recommended fix is to apply the output size limit unconditionally or add an independent compression ratio check.

Applications using adm-zip 0.6.0 to read or extract untrusted ZIP files can be forced to allocate multi-gigabyte memory buffers, leading to high memory consumption and potential process crashes or out-of-memory conditions. This impacts any scenario where untrusted ZIP files are processed, such as upload handlers, continuous integration artifact extraction, or email attachment scanning. There is no impact on confidentiality or integrity, only availability due to resource exhaustion.

A patch is available for adm-zip that fixes this vulnerability by ensuring the decompression output size limit is applied regardless of the declared uncompressed size value. Users should upgrade to a fixed version (>=0.6.1) once available. Until patched, avoid processing untrusted ZIP files with adm-zip 0.6.0 or implement additional input validation to reject ZIP entries with a declared uncompressed size of zero.