Threats affecting pkg:github/zchunk/zchunk

CVE-2026-117556 is a heap out-of-bounds read vulnerability in zchunk versions before 1.5.5. The flaw occurs in the read_preface() function where the total header length is incorrectly passed to compressed integer parsing functions, leading to reads beyond the allocated heap buffer. A crafted .zck file with a header ending inside a compressed integer can trigger this, causing application crashes.