CVE-2026-92000highCWE-409

CVE-2026-92000: high-severity vulnerability in cthackers adm-zip

adm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed Size

Published · Updated

Follow this CVE+ Monitor adm-zip+ Monitor adm-zip

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.7%
adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring zero size to exhaust memory and cause denial of service.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
cthackers · adm-zip
Related CVEs — cthackers adm-zip

In the same product, most dangerous first.

CVE-2026-77301HIGHadm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)EPSS 0.6%CVE-2026-114102HIGHadm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error EventEPSS 0.5%CVE-2026-114103MEDIUMadm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync()EPSS 0.4%CVE-2026-114104HIGHadm-zip before 0.6.1 Duplicate ZIP Entry Name Validation BypassEPSS 0.3%CVE-2026-116137MEDIUMadm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent NamesEPSS 0.3%CVE-2026-102282HIGHadm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalationEPSS 0.2%