Bug 2560934 (CVE-2026-115905) - CVE-2026-115905 zip2: zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE
Summary: CVE-2026-115905 zip2: zip: Critical Parser Differential & Security Control By...
Keywords:
Status: NEW
Alias: CVE-2026-115905
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2566257 2566258 2566259 2566260 2566261 2566262 2566263 2566264 2566265 2566266 2566267 2566268 2566270 2566271 2566273 2566274 2566275 2566276 2566277 2566278 2566269 2566272
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-26 16:34 UTC by OSIDB Bzimport
Modified: 2026-11-04 16:54 UTC (History)
53 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-26 16:34:25 UTC 
zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in src/read/stream.rs. A crafted archive can therefore appear benign to a component that inspects the central directory but cause a streaming extractor to write a different attacker-selected path and content, potentially overwriting files used by a downstream service. This issue is fixed in version 9.0.5.
Note You need to log in before you can comment on or make changes to this bug.