MobSF, a mobile application security testing platform, contains a vulnerability in the unzip routine used by its Static Analyzer. Before version 4.5.1, when the utility encountered an archive entry larger than ZIP_MAX_UNCOMPRESSED_FILE_SIZE, it logged a warning but failed to advance to the next member. As a result, an attacker who can upload a ZIP or APK could craft a file with one oversized component that is extracted to disk while the cumulative extracted size stays under the overall limit. The extra extraction consumes disk space that is then unavailable for subsequent scans, effectively turning the tool into a denial‑of‑service target. The weakness is classified as resource exhaustion (CWE‑400).

The impact is limited to installations of MobSF prior to release 4.5.1. All versions of the Mobile‑Security‑Framework‑MobSF that do not include the patch are vulnerable. The affected product is the MobSF framework, specifically the Static Analyzer module that processes ZIP and APK files.

The CVSS score of 4.9 indicates a moderate severity. EPSS data is not available, so the likelihood of exploitation is uncertain, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed recent exploits. The attack requires a valid user session in MobSF to upload a malicious archive; thus the vector is internal, authenticated. Mitigation is to patch the tool to 4.5.1 or later, which restores correct per‑file size enforcement and resumes extraction of valid members. Until a patch is applied, disabling archive uploads or tightening size limits and monitoring disk usage provide temporary safeguards.