CVE-2026-117556
MEDIUM
MEDIUM
Priority: 0.02
BB Relevance:
61/100
Published: 2026-10-27
Modified: 2026-10-28
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Auth
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
Passive
AT:
None
VC:
None
VI:
None
VA:
Low
Description
zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in read_preface() in src/lib/header.c that passes the total header length instead of remaining bytes to compint parsing functions. Attackers can supply a crafted .zck file whose header ends inside a compressed integer, causing reads past the heap header buffer and crashing the application.