Live › vulnerability › CVE-2026-117556
Go to dashboardzchunk before 1.5.5 passes the total header length instead of the remaining bytes to its compressed-integer parser in read_preface(). A crafted .zck file whose header ends mid-integer makes the parser read past the heap buffer, crashing the application.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Systems that parse .zck files from untrusted sources with zchunk before 1.5.5, such as package tooling that downloads zchunk-compressed repository metadata. The sources describe a crash, not code execution, and do not say which downstream tools embed the library.
No product ranges from the sources yet.
zck --version or check the installed zchunk package version; versions below 1.5.5 are affected.1.5.5 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in read_preface() in src/lib/header.c that passes the total header length instead of remaining bytes to compint parsing functions. Attackers can supply a crafted .zck file whose header ends inside a compressed integer, causing reads past the heap header buffer and crashing the application.
This page as .md · .json · in your agent: get_signal("CVE-2026-117556")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.