Bug#1142906: unzip: heap buffer overflow WRITE in memextract() STORED path [CAN-2026-2034442]

[Akhil Koul]

Hi Paul,


  The PoC zip is completely synthetic — I crafted it from scratch to
trigger the specific code path. It's not based on a real VMS zip file.
The key elements are just: version_made_by with VMS host byte (0x02),
and an EF_IZVMS extra field (ID

  0x000C) with cmptype=BCDEFL and a STORED method byte inside, where
csiz > usiz.


  Happy to test your patch against it once it's ready.


  Akhil

On Thu, Jul 30, 2026 at 12:27 PM Paul Marquess
<paul.marqu...@outlook.com> wrote:
>
> I have a tentative patch done for this . Just need to find a VMS person to 
> review it.
>
>