zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-115905 · Microsoft / collected KEV context

EUVD-2026-109981

GHSA-m665-v7pm-7grj

cve-program · CVE-2026-115905

• https://github.com/zip-rs/zip2/security/advisories/GHSA-m665-v7pm-7grj
• https://github.com/zip-rs/zip2/commit/8068ab480ccf8daa7411424e365fcdbe6d09443e
• https://github.com/zip-rs/zip2/releases/tag/v9.0.5

euvd · EUVD-2026-109981

• https://github.com/zip-rs/zip2/security/advisories/GHSA-m665-v7pm-7grj
• https://github.com/zip-rs/zip2/commit/8068ab480ccf8daa7411424e365fcdbe6d09443e
• https://github.com/zip-rs/zip2/releases/tag/v9.0.5

nvd · CVE-2026-115905

• https://github.com/zip-rs/zip2/commit/8068ab480ccf8daa7411424e365fcdbe6d09443e
• https://github.com/zip-rs/zip2/releases/tag/v9.0.5
• https://github.com/zip-rs/zip2/security/advisories/GHSA-m665-v7pm-7grj

osv · GHSA-m665-v7pm-7grj

• https://github.com/zip-rs/zip2/security/advisories/GHSA-m665-v7pm-7grj
• https://nvd.nist.gov/vuln/detail/CVE-2026-115905
• https://github.com/zip-rs/zip2/commit/8068ab480ccf8daa7411424e365fcdbe6d09443e
• https://github.com/zip-rs/zip2
• https://github.com/zip-rs/zip2/releases/tag/v9.0.5

• zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames wit… · Advisory content revised · 2 Nov 2026
• zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames wit… · Advisory content revised · 30 Oct 2026
• zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE · Newly collected advisory · 28 Oct 2026
• zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE · Newly collected advisory · 26 Oct 2026