fflate unzipSync memory corruption flaw

Public attack code exists for an unzip library; programs using it can be hacked.

Summary

The unzipSync function in fflate up to 0.8.3 corrupts memory and can be attacked remotely. Public exploit code exists, and the vendor did not respond to early disclosure.

Affected when

Use of the unzipSync function

What to do

Confirm the program uses a version newer than 0.8.3 and read the vendor's advisory.

Products and platforms

101arrowz fflate

CVE IDs

CVE-2026-122146 (opens in a new tab)

Sources

Write-up: vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · github.com (opens in a new tab)
CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-05 00:45 UTC

First seen 2026-11-09 16:20 UTC