{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-117556", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-27T11:25:20.941Z", "datePublished": "2026-10-27T13:07:51.708Z", "dateUpdated": "2026-10-28T16:17:15.487Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-27T13:07:51.708Z"}, "datePublic": "2026-10-22T00:00:00.000Z", "title": "zchunk before 1.5.5 Heap Out-of-Bounds Read via read_preface()", "descriptions": [{"lang": "en", "value": "zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in read_preface() in src/lib/header.c that passes the total header length instead of remaining bytes to compint parsing functions. Attackers can supply a crafted .zck file whose header ends inside a compressed integer, causing reads past the heap header buffer and crashing the application."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Out-of-bounds Read", "cweId": "CWE-125", "type": "CWE"}]}], "affected": [{"vendor": "zchunk", "product": "zchunk", "defaultStatus": "unaffected", "versions": [{"status": "affected", "version": "0", "lessThan": "1.5.5", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:zchunk:zchunk:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.5.5"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/zchunk/zchunk/issues/119", "tags": ["issue-tracking"], "name": "GitHub Issue #119"}, {"url": "https://github.com/zchunk/zchunk", "tags": ["product"]}, {"url": "https://github.com/zchunk/zchunk/commit/02b371a64bf98245df97315d07c684a0ca5ea1df", "tags": ["patch"]}, {"url": "https://github.com/zchunk/zchunk/releases/tag/1.5.5", "tags": ["release-notes"], "name": "zchunk 1.5.5 Release Notes"}, {"url": "https://github.com/zchunk/zchunk/blob/1.5.4/src/lib/header.c#L167", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: zchunk before 1.5.5 Heap Out-of-Bounds Read via read_preface()", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/zchunk-before-1.5.5-heap-out-of-bounds-read-via-read-preface"}], "credits": [{"lang": "en", "value": "HaiND from the Post and Telecommunication Institute of Technology", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-28T15:54:22.919848Z", "id": "CVE-2026-117556", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-28T16:17:15.487Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-117556", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-28T15:54:22.919848Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-28T15:54:24.009Z"}}], "cna": {"title": "zchunk before 1.5.5 Heap Out-of-Bounds Read via read_preface()", "credits": [{"lang": "en", "type": "finder", "value": "HaiND from the Post and Telecommunication Institute of Technology"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "zchunk", "product": "zchunk", "versions": [{"status": "affected", "version": "0", "lessThan": "1.5.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-10-22T00:00:00.000Z", "references": [{"url": "https://github.com/zchunk/zchunk/issues/119", "name": "GitHub Issue #119", "tags": ["issue-tracking"]}, {"url": "https://github.com/zchunk/zchunk", "tags": ["product"]}, {"url": "https://github.com/zchunk/zchunk/commit/02b371a64bf98245df97315d07c684a0ca5ea1df", "tags": ["patch"]}, {"url": "https://github.com/zchunk/zchunk/releases/tag/1.5.5", "name": "zchunk 1.5.5 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/zchunk/zchunk/blob/1.5.4/src/lib/header.c#L167", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/zchunk-before-1.5.5-heap-out-of-bounds-read-via-read-preface", "name": "VulnCheck Advisory: zchunk before 1.5.5 Heap Out-of-Bounds Read via read_preface()", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in read_preface() in src/lib/header.c that passes the total header length instead of remaining bytes to compint parsing functions. Attackers can supply a crafted .zck file whose header ends inside a compressed integer, causing reads past the heap header buffer and crashing the application."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "Out-of-bounds Read"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zchunk:zchunk:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.5.5"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-27T13:07:51.708Z"}}}, "cveMetadata": {"cveId": "CVE-2026-117556", "state": "PUBLISHED", "dateUpdated": "2026-10-28T16:17:15.487Z", "dateReserved": "2026-10-27T11:25:20.941Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-27T13:07:51.708Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "zchunk", "vendor": "zchunk", "versions": [{"lessThan": "1.5.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in read_preface() in src/lib/header.c that passes the total header length instead of remaining bytes to compint parsing functions. Attackers can supply a crafted .zck file whose header ends inside a compressed integer, causing reads past the heap header buffer and crashing the application."}], "id": "CVE-2026-117556", "lastModified": "2026-10-28T17:18:13.257", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-117556", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-28T15:54:22.919848Z", "version": "2.0.3"}}]}, "published": "2026-10-27T14:16:36.340", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/zchunk/zchunk"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/zchunk/zchunk/blob/1.5.4/src/lib/header.c#L167"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/zchunk/zchunk/commit/02b371a64bf98245df97315d07c684a0ca5ea1df"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/zchunk/zchunk/issues/119"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/zchunk/zchunk/releases/tag/1.5.5"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/zchunk-before-1.5.5-heap-out-of-bounds-read-via-read-preface"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "zchunk: zchunk: Denial of Service via malformed file header", "id": "2561968", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2561968"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-125", "details": ["zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in read_preface() in src/lib/header.c that passes the total header length instead of remaining bytes to compint parsing functions. Attackers can supply a crafted .zck file whose header ends inside a compressed integer, causing reads past the heap header buffer and crashing the application.", "A flaw was found in zchunk. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by tricking an application into processing a specially crafted file. Improper boundary checking during file header parsing causes the program to read beyond the allocated memory buffer, leading to an application crash."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-117556", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "zchunk", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-10-27T13:07:51Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-117556\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-117556\nhttps://github.com/zchunk/zchunk\nhttps://github.com/zchunk/zchunk/blob/1.5.4/src/lib/header.c#L167\nhttps://github.com/zchunk/zchunk/commit/02b371a64bf98245df97315d07c684a0ca5ea1df\nhttps://github.com/zchunk/zchunk/issues/119\nhttps://github.com/zchunk/zchunk/releases/tag/1.5.5\nhttps://www.vulncheck.com/advisories/zchunk-before-1.5.5-heap-out-of-bounds-read-via-read-preface"], "statement": "This vulnerability is rated as having a Low severity impact because exploitation requires a victim or automated process to handle an untrusted file, with consequences limited to an unexpected termination of the decompression process. In Red Hat environments, zchunk is typically invoked during package metadata operations against trusted, cryptographically verified repositories, which drastically limits exposure to malicious input. Because the memory violation affects only transient user-space execution and does not provide opportunities for system compromise or unauthorized access, the overall risk to supported systems is minimal.", "threat_severity": "Low"}