CVE-2026-117556— zchunk before 1.5.5 Heap Out-of-Bounds Read via read_preface()

Quick assessment

Affected

zchunk zchunk

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

zchunk 1.5.5 之前的版本在的函数中存在堆越界读取漏洞。该函数错误地将整个标头长度而非剩余字节数传递给压缩整数解析函数。攻击者可构造一个特制的文件，使其标头终止于压缩整数内部，从而引发超出堆标头缓冲区的读取操作，导致应用程序崩溃。

CVSS 4.3 · Medium Updated Oct 27, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

zchunk before 1.5.5 Heap Out-of-Bounds Read via read_preface()

Source: CVE Program / CVE List V5

Vulnerability Description

zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in read_preface() in src/lib/header.c that passes the total header length instead of remaining bytes to compint parsing functions. Attackers can supply a crafted .zck file whose header ends inside a compressed integer, causing reads past the heap header buffer and crashing the application.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存读

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
zchunk	zchunk	0 ~ 1.5.5	-

II. Public POCs for CVE-2026-117556

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-117556

请登录查看更多情报信息。

Other References for CVE-2026-117556 (6)

https://github.com/zchunk/zchunk product
https://github.com/zchunk/zchunk/commit/02b371a64bf98245df97315d07c684a0ca5ea1df patch
https://github.com/zchunk/zchunk/blob/1.5.4/src/lib/header.c#L167 technical-description
https://github.com/zchunk/zchunk/issues/119 issue-tracking
https://github.com/zchunk/zchunk/releases/tag/1.5.5 release-notes
https://www.vulncheck.com/advisories/zchunk-before-1.5.5-heap-out-of-bounds-read-via-read-preface third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-117556

IV. Related Vulnerabilities

Same weakness: CWE-125