Hi,
InfoZIP unzip 6.0 contains a heap buffer overflow WRITE in the
memextract() function (extract.c) when processing STORED-compressed
VMS extra field blocks. The allocation uses the declared uncompressed
size (usiz), but the STORED copy path uses the compressed data length
(G.incnt, derived from csiz). When csiz > usiz, memcpy writes past
the heap buffer.
CAN: CAN-2026-2034442 (pending assignment from MITRE)
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS: 8.5 High
ROOT CAUSE:
In extract_izvms_block() (extract.c, line 2645):
usiz = (cmptype == EB_IZVMS_BCSTOR ?
csiz : makeword(ebdata+EB_IZVMS_UCSIZ));
...
ucdata = (uch *)malloc(MAX(needlen, usiz)); // alloc'd with usiz
For the EB_IZVMS_BCDEFL case, memextract() is called:
memextract(__G__ ucdata, (ulg)usiz,
ebdata+EB_IZVMS_HLEN, (ulg)csiz);
Inside memextract() (extract.c, line 2523), the STORED path:
G.inptr = (uch *)src + (2 + 4);
G.incnt = (int)(G.csize = (long)(srcsize - (2 + 4))); // from csiz
...
case STORED:
memcpy((char *)tgt, (char *)G.inptr, (extent)G.incnt);
The memcpy uses G.incnt (derived from srcsize/csiz) as the copy length,
but tgt is only usiz bytes. The method field inside the extra field data
is attacker-controlled — a crafted EF_IZVMS block declares
cmptype=EB_IZVMS_BCDEFL (to reach memextract) with a method byte of
STORED=0 inside the block data, usiz=16, and csiz=86. The memcpy then
copies 80 bytes into a 16-byte buffer.
TRIGGER: unzip -a -o poc.zip where poc.zip has version_made_by=0x0214
(VMS host system) and contains a crafted EF_IZVMS extra field with
the above geometry.
ASAN OUTPUT:
==8==ERROR: AddressSanitizer: heap-buffer-overflow on address
0xffff98400740 at pc 0xaaaacd723054
WRITE of size 80 at 0xffff98400740 thread T0
#0 __asan_memcpy
#1 memextract /build/unzip-6.0/extract.c:2523:13
#2 extract_izvms_block /build/unzip-6.0/extract.c:2660:13
#3 is_vms_varlen_txt /build/unzip-6.0/fileio.c:1181:32
#4 flush /build/unzip-6.0/fileio.c:896:17
#5 extract_or_test_member /build/unzip-6.0/extract.c:1921:21
0xffff98400740 is located 0 bytes to the right of 16-byte region
[0xffff98400730,0xffff98400740)
allocated by thread T0 here:
#1 extract_izvms_block /build/unzip-6.0/extract.c:2645:26
IMPACT: Heap buffer overflow WRITE with attacker-controlled length
(csiz - usiz - 6 bytes written past the allocation). This is a
write primitive — potential for code execution depending on heap
layout. Triggered during normal extraction of a crafted ZIP file.
SUGGESTED FIX (in memextract, STORED case):
case STORED:
+ if ((extent)G.incnt > tgtsize) {
+ error = PK_ERR;
+ break;
+ }
memcpy((char *)tgt, (char *)G.inptr, (extent)G.incnt);
Or equivalently, validate in extract_izvms_block() that csiz <= usiz + 6
before calling memextract with cmptype BCDEFL.
Best regards,
Akhil Koul
Can you upload the zip file you used to generate the issue please?
Hi Paul, Thanks for looking into this. PoC zip attached. Trigger: unzip -o poc_memextract_stored.zip It's a minimal zip (316 bytes) with version_made_by=VMS and an EF_IZVMS extra field (ID 0x000C) containing: - cmptype = EB_IZVMS_BCDEFL (enters the memextract path) - usiz = 16 (drives the malloc) - Inner method byte = 0 (STORED, hits the memcpy path) - csiz = 86 (drives G.incnt = 80 after the 6-byte header) → memcpy copies 80 bytes into a 16-byte buffer (64-byte overflow) Under ASan (Debian unzip built with -fsanitize=address): ERROR: AddressSanitizer: heap-buffer-overflow WRITE of size 80 Apologies for not including it with the initial report — will attach PoC zips to future submissions. Thanks for the fast turnaround on the other two patches. Best, Akhil
This one is the only one for which I don't have the official fix yet. Thanks.
Is the poc zip file completely contrived, or is it based on an existing zip file? I ask because I created a zip from scratch to test this, but it may lack some of the VMS features of a real zip created on a VMS system. Been decades since I used VMS. PAul
I have a tentative patch done for this . Just need to find a VMS person to review it.
Hi Paul, The PoC zip is completely synthetic — I crafted it from scratch to trigger the specific code path. It's not based on a real VMS zip file. The key elements are just: version_made_by with VMS host byte (0x02), and an EF_IZVMS extra field (ID 0x000C) with cmptype=BCDEFL and a STORED method byte inside, where csiz > usiz. Happy to test your patch against it once it's ready. Akhil
We believe that the bug you reported is fixed in the latest version of
unzip, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1142906@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Santiago Vila <sanvila@debian.org> (supplier of updated unzip package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 10 Aug 2026 19:10:00 +0200
Source: unzip
Architecture: source
Version: 6.0-31
Distribution: unstable
Urgency: medium
Maintainer: Santiago Vila <sanvila@debian.org>
Changed-By: Santiago Vila <sanvila@debian.org>
Closes: 1142906
Changes:
unzip (6.0-31) unstable; urgency=medium
.
* Apply upstream fix for CAN-2026-2034442. Closes: #1142906.
(heap buffer overflow WRITE in memextract() STORED path)
Checksums-Sha1:
40274f7f2a89a9243542a3abb26a6681d64fa913 1463 unzip_6.0-31.dsc
e807f4edb0cc452c3937bd4e4cc79cd049049821 27232 unzip_6.0-31.debian.tar.xz
86c2acbdf53b97c0ca79e5f29b413911dce01222 5476 unzip_6.0-31_source.buildinfo
Checksums-Sha256:
1e3454cb496ae8587c265741f396c0fe7d509c6f65eb02e7f8cda3554fd5680f 1463 unzip_6.0-31.dsc
d7dc23f5254c6711dc05f467e70236cfd50a7931001c6152904474b19f295c38 27232 unzip_6.0-31.debian.tar.xz
fc4588f2073f90541dfd1d71fa903e2abfe3f0e9493c32a141b988a352b6c9c2 5476 unzip_6.0-31_source.buildinfo
Files:
3b6e15148f279773c6b443fd22c21880 1463 utils optional unzip_6.0-31.dsc
7788943231cba5e5ab2ca103aea730f8 27232 utils optional unzip_6.0-31.debian.tar.xz
42c2d0034cb51122b432c5fd972ec398 5476 utils optional unzip_6.0-31_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQEzBAEBCgAdFiEE1Uw7+v+wQt44LaXXQc5/C58bizIFAmp6CQgACgkQQc5/C58b
izKmYQf9GAyOSpa9QtLxB4rbsd+oGN1DkpCXDTpg+3433iD8M2fviI0dfWxnWyx8
d+4RKAqu1JUfsbem0Jzi2tUow6lub4BIJrTAJCCIyNzAPc2LpdsTTucJI6zPN+Vj
EPiElIuoTwJcedwE7MXaMDQRTCwp1tiJQr5ojPcu60K8RMLGX0UamCTe3WggF2MC
XxBf9pYiopcc3VsUHIOY/p157KYMuSkd6Y5yMFgy135ASxl+b+54/XAwF04yMmdF
h4eK2JJNb1iwlpzDgfUuytA9SkeeeUKQT0fm6zW+zW2VtvbxI7M6X9Jlsa6q299M
DeziOp5Pmp577jz3xwaqufntgcN9Jw==
=7SFT
-----END PGP SIGNATURE-----
We believe that the bug you reported is fixed in the latest version of
unzip, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1142906@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Santiago Vila <sanvila@debian.org> (supplier of updated unzip package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 11 Aug 2026 00:10:00 +0200
Source: unzip
Architecture: source
Version: 6.0-29+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: Santiago Vila <sanvila@debian.org>
Changed-By: Santiago Vila <sanvila@debian.org>
Closes: 1142904 1142905 1142906
Changes:
unzip (6.0-29+deb13u1) trixie-security; urgency=high
.
* Apply upstream fix for CAN-2026-2034440. Closes: #1142904.
(heap out-of-bounds read in EF_IZUNIX3 extra field handler)
* Apply upstream fix for CAN-2026-2034443. Closes: #1142905.
(stack out-of-bounds NUL write in EF_SMARTZIP handler)
* Apply upstream fix for CAN-2026-2034442. Closes: #1142906.
(heap buffer overflow WRITE in memextract() STORED path)
Checksums-Sha1:
42334eabbc696974f21dfce2a68823e97a76a79c 1495 unzip_6.0-29+deb13u1.dsc
abf7de8a4018a983590ed6f5cbd990d4740f8a22 1376845 unzip_6.0.orig.tar.gz
e454737ecda044fbfa4172f282d1b437a1257939 27112 unzip_6.0-29+deb13u1.debian.tar.xz
1ce8d3add1e144124cab87b7f2e804724f76fc4c 5108 unzip_6.0-29+deb13u1_source.buildinfo
Checksums-Sha256:
b700df33b987c07f3d6435b175e0c2c924368d8c6e4efdcd2adf730ed69d4405 1495 unzip_6.0-29+deb13u1.dsc
036d96991646d0449ed0aa952e4fbe21b476ce994abc276e49d30e686708bd37 1376845 unzip_6.0.orig.tar.gz
32716adbdf903ee4e7e28f8c9884fc3459b22b2214e0ff4cefc0ab9839f43481 27112 unzip_6.0-29+deb13u1.debian.tar.xz
6466573510b0ef8bd825bfb980dbe4df9a9588872e56b75db0e8d94b7ae39348 5108 unzip_6.0-29+deb13u1_source.buildinfo
Files:
fb7b25488ed4028444633dc24fcb0e97 1495 utils optional unzip_6.0-29+deb13u1.dsc
62b490407489521db863b523a7f86375 1376845 utils optional unzip_6.0.orig.tar.gz
dba8d050188fd87fb9101e26d6eaed2f 27112 utils optional unzip_6.0-29+deb13u1.debian.tar.xz
edb182d881fbb2cc53f997d5a5d75125 5108 utils optional unzip_6.0-29+deb13u1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQEzBAEBCgAdFiEE1Uw7+v+wQt44LaXXQc5/C58bizIFAmp68I0ACgkQQc5/C58b
izJEiAf/bD1tQ/7KrG3mEmaQ3XC8lcwayl+ACFgblKXXj0zKX5XX7D3i04gKiD8Q
0DrV9PQCfrMK+pLdCub69H+4kmUamP6Y+aGoLECy02nGdF9Akk87yAP5ZOUJgHrz
kPF5+Ts8kQl6/mDx+DKBI/hzWv2CylqIi80KXZb4i+dMdqIUDTgk7oY5/N7FtsNJ
FZ1BdCPxoRV4LTDbi6RHnxqdTFSJ1cvKtt7p0GqY6omYksMNWChHFNAFSfHVcb1Q
iD6bXmPnOu61srlvRBuZ0uDHaUvvwKzSf5cKSS1VkZjvhuNIcPa4GG41Vb39K6jr
A3QYWl5pT5cXn6ITJbYmxNaESIIMbg==
=A/a6
-----END PGP SIGNATURE-----