zchunk vulnerabilities

CVEs whose affected-version data names the zchunk package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-117556Medium· 4.3

1w ago

zchunk before 1.5.5 Heap Out-of-Bounds Read via read_preface()

zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in read_preface() in src/lib/header.c that passes the total header length instead of remaining bytes to compint parsing functions. Attackers can supply a crafted .zck f…

▾ Sunlitzchunk · zchunkEPSS 0.33%via CVEORG