CVSS 3.1 base metricsRed raises the risk · green lowers it
Attack vector
NetworkAV:N
Attack complexity
LowAC:L
Privileges required
NonePR:N
User interaction
NoneUI:N
Scope
UnchangedS:U
Confidentiality
NoneC:N
Integrity
NoneI:N
Availability
HighA:H
Updates that fix it
0 KBs
No KB listed
No KB update is listed in the collected MSRC record. Check the MSRC advisory for product releases and other remedies.
Affected products
Open Source Software
3 affected products
azl3 rust 1.75.0-31 on Azure Linux 3.0
azl3 rust 1.96.1-2 on Azure Linux 3.0
azl3 rust 1.98.1-1 on Azure Linux 3.0
What changed
Affected products: azl3 rust 1.75.0-31 on Azure Linux 3.0, azl3 rust 1.96.1-2 on Azure Linux 3.0 → azl3 rust 1.75.0-31 on Azure Linux 3.0, azl3 rust 1.96.1-2 on Azure Linux 3.0, azl3 rust 1.98.1-1 on Azure Linux 3.0 · CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H → CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U
Page history
Changes are dated when recorded; day views use the last saved version from that UTC day, and citations stay fixed.
2 Nov 2026 · 09:04:36 UTCAffected productsazl3 rust 1.75.0-31 on Azure Linux 3.0, azl3 rust 1.96.1-2 on Azure Linux 3.0 → azl3 rust 1.75.0-31 on Azure Linux 3.0, azl3 rust 1.96.1-2 on Azure Linux 3.0, azl3 rust 1.98.1-1 on Azure Linux 3.0
2 Nov 2026 · 09:04:36 UTCCVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H → CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U
CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.
No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.
Dated risk observations
Risk history is separate from CNA/OSV content history. Daily score drift is retained but only an upward crossing of 10% triggers the prediction change event.
Immutable source observations
8 recorded revisions
Each citation identifies one complete source statement. Source modification dates and the time this installation observed them are distinct. Latest history includes records historically associated by source identifiers; a removed alias is not a current equivalence claim. Exact citations show that source record's own earlier observations. Failed reads and unchanged polls do not rewrite history.
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::with_capacity for a symbolic link target using the attacker-controlled ZIP64 uncompr…
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::with_capacity for a symbolic link target using the attacker-controlled ZIP64 uncompr…