THREAT OPS › Threat News › [GHSA] GHSA-7q85-xj36-vmfc (high) — adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)
[GHSA] GHSA-7q85-xj36-vmfc (high) — adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)
GHSA-7q85-xj36-vmfc Severity: high CVE: CVE-2026-77301
adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)
### Summary adm-zip allocates an entry's output buffer from the declared uncompressed size (central-directory `size` field) before validating it against the actual data. A tiny crafted ZIP that declares a huge uncompressed size forces a multi-gigabyte allocation
MITRE ATT&CK techniques
- ServerlessT1583.007
- ServerlessT1584.007
- ServerlessAML.T0008.004
Indicators of compromise
- 980d34356fbb248fe527b9d0ac3eabc5c99393a374014be6199523de16709386sha256
- CVE-2026-77301cve
Original source: https://github.com/advisories/GHSA-7q85-xj36-vmfc