CVE-2026-39244

A flaw was found in adm-zip. A remote attacker can exploit this vulnerability by providing a specially crafted ZIP file. The file's header can be manipulated to declare an extremely large uncompressed size, causing the application to allocate an excessive amount of memory. This excessive memory allocation can lead to an immediate process crash, resulting in a Denial of Service (DoS) for any application processing untrusted ZIP files with adm-zip.

A denial of service flaw exists in adm-zip, affecting applications that process untrusted ZIP archives. A specially crafted ZIP file with a manipulated uncompressed size header can lead to excessive memory allocation, causing an immediate process crash. This vulnerability can be exploited remotely without authentication, as the memory allocation occurs before CRC validation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.