The flaw in unarr 1.1.1 permits a heap‑based out‑of‑bounds read within the zip_parse_extra_fields function, caused by an incorrect ZIP64 extra field length check. An attacker can supply a specially crafted ZIP archive containing 0xFFFFFFFF sentinel values and a truncated ZIP64 record, which forces the function to read past the intended heap buffer and crash the process. The resulting denial of service is the primary concern highlighted in the advisory.

The vulnerability affects the selmf unarr library version 1.1.1. All installations of this specific release are susceptible.

With a CVSS score of 6.8, the vulnerability is considered moderate severity. EPSS score is < 1%, indicating a low exploitation probability. The lack of a KEV listing suggests that widespread exploitation is not yet known. The likely attack vector is an untrusted ZIP file supplied to any application that uses unarr 1.1.1. If exploited, the attacker can trigger a crash.