zip has 9 CVEs on record between 2025 and 2026. Disclosure cadence is accelerating: 8 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 8. The median CVSS is 7.5 (high), with 2 rated critical. None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 8 prev 0
Weakness classes
Products
- zip 9
Worst active — by depth score
CVE-2026-115905Critical· 10.0zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Over…67RUSTSEC-2026-0369Critical· 9.1ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target50CVE-2026-115909High· 7.5zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction41CVE-2026-115908High· 7.4zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. 41CVE-2026-115907High· 7.5zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size41
zip vulnerabilities
CVEs affecting zip, newest first. Open any entry for full detail, references, and exploit status.
9 CVEsRSS
CVE-2026-115906Medium· 6.5zip: AES Entry HMAC Authentication Bypass on Premature EOF
zip: AES Entry HMAC Authentication Bypass on Premature EOF
CVE-2026-115907High· 7.5zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size
zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size
CVE-2026-115908High· 7.4zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.
zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.
CVE-2026-115909High· 7.5zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction
zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction
CVE-2026-115905Critical· 10.0PoCzip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Over…
zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE
RUSTSEC-2026-0369Critical· 9.1ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target
ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target
RUSTSEC-2026-0368Nonezip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory
zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory
RUSTSEC-2026-0367High· 7.3Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation
Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation
CVE-2025-29787HighIncorrect path canonicalization during Archive Extraction Leading to Arbitrary File Write
Incorrect path canonicalization during Archive Extraction Leading to Arbitrary File Write