CVE-2026-111141: Out-of-bounds Read in gdraheim zziplib

The vulnerability exists in zziplib through version 0.13.80 within the __zzip_parse_root_directory() function in zzip/zip.c. The issue arises from an ineffective bounds check when reading the central directory in memory-mapped builds. An attacker can supply a specially crafted ZIP archive whose entry name ends exactly at the central directory end, causing zzip_dir_open() to over-read 28 bytes of the ZIP64 extra field. This out-of-bounds read can lead to a crash of the affected process.

Successful exploitation can cause the affected process to crash due to out-of-bounds memory reads. There is no indication of code execution or data corruption beyond the crash. The attack requires local access (attack vector: local) with high attack complexity and partial user interaction. The vulnerability does not affect confidentiality, integrity, or availability beyond causing a denial of service via process crash.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted or crafted ZIP files with vulnerable versions of zziplib. Monitor vendor channels for updates or patches addressing this issue.