CVE-2026-92000highCWE-409

CVE-2026-92000: falha de alta gravidade em cthackers adm-zip

adm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed Size

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar adm-zip+ Monitorar adm-zip

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.7%
adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring zero size to exhaust memory and cause denial of service.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
cthackers · adm-zip
CVEs relacionadas — cthackers adm-zip

No mesmo produto, das mais perigosas para as menos.

CVE-2026-77301HIGHadm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)EPSS 0.6%CVE-2026-114102HIGHadm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error EventEPSS 0.5%CVE-2026-114103MEDIUMadm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync()EPSS 0.4%CVE-2026-114104HIGHadm-zip before 0.6.1 Duplicate ZIP Entry Name Validation BypassEPSS 0.3%CVE-2026-116137MEDIUMadm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent NamesEPSS 0.3%CVE-2026-102282HIGHadm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalationEPSS 0.2%