Technical impact
The flaw resides in the adm-zip JavaScript library prior to version 0.5.18. A crafted ZIP archive containing a central directory entry that declares an uncompressed size far larger than the actual compressed data causes the library to allocate a buffer based solely on that header value. This silent allocation occurs before CRC validation, allowing an attacker to trigger an extreme memory amplification—roughly a 33-million-to-1 ratio when the archive declares a 4 GB uncompressed size. All extraction and read APIs, including readFile(), extractEntryTo(), and test(), are susceptible, and the defect leads to an abrupt process crash, constituting a denial-of-service attack.
Affected Systems
Any application or service that imports and uses the adm-zip library to process ZIP files from untrusted sources is affected, provided the library version is earlier than 0.5.18. No specific vendors or product lineages are listed by the CNA.
Risk and Exploitability
The CVSS score of 7.5 indicates high severity. The EPSS score of < 1% and the absence from the CISA KEV catalog suggest that, at this time, there is no widespread exploitation evidence. Attackers can exploit the vulnerability by supplying a malicious ZIP file; the lack of bounds checking makes the exploitation path straightforward for any user of adm-zip. It is inferred that a single malicious ZIP file delivered in one request could trigger the crash if system resources are exhausted, but this inference is based on the described behavior rather than documented attacks.
Github GHSA