This flaw is a classic out‑of‑bounds read that occurs when __zzip_parse_root_directory processes a ZIP64 archive. The bounds check that should prevent reading past the mapped central directory is ineffective, allowing an attacker to trigger a 28‑byte over‑read of the ZIP64 extra field. The resulting crash does not expose confidential data but can be leveraged for denial of service in environments where zziplib is used to extract archive payloads. The weakness maps to CWE‑125 and is reflected in the CVSS score of 5.7.

The vulnerability affects the zziplib project maintained by gdraheim. All released versions up to and including 0.13.80 are impacted. Users of this library in any build, especially those that enable mmap mapping of ZIP archive entries, must be aware of the issue.

The CVSS score of 5.7 indicates a moderate severity. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, but the flaw is listed as not in the CISA KEV catalog, implying no catalogued exploitation at the time of analysis. Attackers can supply a specially crafted ZIP file to which the library is exposed; the exploit path is straightforward as the vulnerability is triggered purely through file parsing with no additional authentication or privilege escalation required. The impact is a crash, which may be useful for attackers who seek denial of service or to bypass execution controls.