CVE-2026-92000

Publié : 15 septembre 2026

Modifié : 15 septembre 2026

Score CVSS

7.5

HIGH

Description détaillée

adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring zero size to exhaust memory and cause denial of service.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Références et Patchs

https://github.com/cthackers/adm-zip https://github.com/cthackers/adm-zip/blob/v0.6.0/methods/inflater.js https://github.com/cthackers/adm-zip/commit/491600683dacb6cb9fe0718a0eeb9cb5eb49afa6 https://github.com/cthackers/adm-zip/commit/8bc411184de1b5ca28138c53074fb61119994dde https://github.com/cthackers/adm-zip/security/advisories/GHSA-rcw4-f5rp-g42v https://www.vulncheck.com/advisories/adm-zip-0.5.14-through-0.6.0-denial-of-service-via-zero-declared-uncompressed-size

Dernières Vulnérabilités

CVE-2025-11395

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.

VOIR DÉTAILS

CVE-2026-92259

Integer overflow or wraparound vulnerability in Samsung Opensource Escargot allows attackers with write access to the bytecode-cache directory to cause a heap-based buffer overflow and denial of service via a crafted cache file. This issue affects Escargot: ac94df78493ee6fede286620d94f724e46b4d238.

VOIR DÉTAILS

CVE-2026-92257

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in L7 content management pages that use eval() sinks, affecting the call board text and policy group handling components. Attackers can inject persistent script payloads through these pages to have malicious code executed in the context of other users viewing the affected content.

VOIR DÉTAILS