A buffer allocation flaw in the zip-rs/zip2 library's legacy Shrink, Reduce, and Implode decoders allows an attacker to supply a ZIP64 entry with an unbounded uncompressed size; the decoder reserves memory based on this value before validating the compressed data, causing a capacity overflow and an unhandled panic that terminates the application. The vulnerability results in a denial‑of‑service condition. It is rooted in improper input validation and unbounded allocation (CWE‑400, CWE‑789).

The vulnerability affects the zip-rs/zip2 library when the legacy‑zip feature is enabled, covering all releases from version 5.1.0 up to, but not including, 9.0.0. Applications built with this feature that process ZIP archives are susceptible. The library is distributed under the zip‑rs project on GitHub.

The CVSS score of 7.5 indicates a high‑severity problem. No EPSS value is available, and the issue is not listed in the CISA KEV catalog, which suggests it is not a prominently exploited vulnerability yet. An attacker can deliver a malicious ZIP file to any service that uses the vulnerable library, causing a panic during extraction or an unbounded memory preallocation. The exploit is straightforward for code that calls ZipArchive::extract without additional checks on ZIP64 sizes.