High severity · published Sep 15, 2026
CVE-2026-92000
adm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed Size
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring zero size to exhaust memory and cause denial of service.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
adm-zip · cthackers
0.5.14 before 0.6.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-92000
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-92000
github.com
https://github.com/cthackers/adm-zip
github.com
https://github.com/cthackers/adm-zip/blob/v0.6.0/methods/inflater.js
github.com
https://github.com/cthackers/adm-zip/commit/491600683dacb6cb9fe0718a0eeb9cb5eb49afa6
github.com
https://github.com/cthackers/adm-zip/commit/8bc411184de1b5ca28138c53074fb61119994dde
github.com
https://github.com/cthackers/adm-zip/security/advisories/GHSA-rcw4-f5rp-g42v
www.vulncheck.com
https://www.vulncheck.com/advisories/adm-zip-0.5.14-through-0.6.0-denial-of-service-via-zero-declared-uncompressed-size
More from adm-zip
7.5
CVE-2026-114102
adm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error Event
7.5
CVE-2026-77301
adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)
7.1
CVE-2026-102282
adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation
6.5
CVE-2026-76845
adm-zip 0.5.9 through 0.6.0 Arbitrary File Overwrite via Symlink Following on Extraction
6.2
CVE-2026-114105
Adm-zip before 0.6.1 Privilege Escalation via keepOriginalPermission Setuid Bits