Heap-based buffer overflow vulnerability in UzpPassword function was found, possibly allowing arbitrary code execution when uncompressing specially crafted password protected ZIP archives.

Vulnerable code:

[1591]  if ((prompt = (char *)malloc(2*FILNAMSIZ + 15)) != (char *)NULL) {
[1592]          sprintf(prompt, LoadFarString(PasswPrompt),
[1593]                                  FnFilter1(zfn), FnFilter2(efn));
...
[1595]  } 

The buffer can be overrun since the attacker can arbitrarily choose name for files residing inside archive file.