Public vulnerability disclosure
CVE-2026-111274
unarr through 1.1.1 Heap Out-of-Bounds Read via zip_parse_extra_fields
publishedCWE-125
unarr through 1.1.1 contains a heap-based out-of-bounds read in zip_parse_extra_fields() in zip/parse-zip.c due to an incorrect ZIP64 extra field length check. Attackers can supply a crafted ZIP archive with 0xFFFFFFFF sentinel values and a truncated ZIP64 record to read past the heap buffer and crash the process.
Technical severity6.8 mediumCVSS 4.0 · CNA: VulnCheck
Published2026-10-15Source updated 2026-11-02
Collected2026-11-022 attributed sources
Fixes and workarounds
No remediation reported in collected sources.
Missing remediation information is not evidence that no patch exists.
Affected products and versions
| Product | Versions | Authority |
|---|---|---|
| unarr selmf selmf/unarr
github |
≥ 0; ≤ 1.1.1 (affected, semver)
Other versions: unaffected |
CNA: VulnCheck |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 4.0 / 6.8 medium |
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | CNA: VulnCheck |
| 3.1 / 5.5 medium |
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H | CNA: VulnCheck |
Exploit evidence
- https://hackmd.io/@haind-pwn/unarr-tar-zip-oob
exploit · CNA: VulnCheck - https://hackmd.io/@haind-pwn/unarr-tar-zip-oob
exploit · ADP: CISA-ADP
References
- https://github.com/selmf/unarr/security/advisories/GHSA-qm4g-jf39-jwjjCNA: VulnCheck · vendor-advisory
- https://github.com/selmf/unarr/releases/tag/v1.2.0CNA: VulnCheck · release-notes, patch
- https://hackmd.io/@haind-pwn/unarr-tar-zip-oobCNA: VulnCheck · technical-description, exploit
- https://www.vulncheck.com/advisories/unarr-through-1.1.1-heap-out-of-bounds-read-via-zip-parse-extra-fieldsCNA: VulnCheck · third-party-advisory
- https://hackmd.io/@haind-pwn/unarr-tar-zip-oobADP: CISA-ADP · exploit