{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "gdraheim zziplib: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/gdraheim--zziplib/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/gdraheim--zziplib/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111142/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111142/",
   "title": "CVE-2026-111142 · gdraheim zziplib · disclosed",
   "content_text": "Zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzip/mmapped.c that allows attackers to over-read heap memory via a crafted ZIP central directory. Attackers can craft an end-of-central-directory record placing the first entry near the buffer end, causing zzip_disk_entry_strdup_name to read past the buffer and crash the application.",
   "date_published": "2026-10-15T18:57:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111141/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111141/",
   "title": "CVE-2026-111141 · gdraheim zziplib · disclosed",
   "content_text": "zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory() in zzip/zip.c that allows attackers to read past the mapped central directory in mmap builds due to an ineffective bounds check. Attackers can supply a crafted ZIP whose entry name ends at the central directory end, triggering 28-byte ZIP64 extra field over-reads via zzip_dir_open() that crash the process.",
   "date_published": "2026-10-15T18:57:33Z"
  }
 ]
}