The vulnerability is a heap out-of-bounds read in the read_preface() function of zchunk. A malicious .zck file that terminates its header inside a compressed integer can cause the library to read past the end of its heap header buffer, leading to a crash or denial of service. The flaw is classified as CWE‑125 and does not give an active code‑execution or information disclosure capability beyond application termination.

All versions of zchunk before 1.5.5 are affected, including the 1.5.4 release and any earlier iterations of the library. The issue is specific to the zchunk project and does not affect other vendors.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attacker must supply a crafted .zck file to the target application; the attack vector depends on whether the application processes untrusted files locally or over a network. No publicly known exploits exist, but the crash can disrupt services relying on the zchunk library.