Rust zip-rs/zip2: Arbitrary file overwrite and RCE via ZIP header mismatch (CVE-2026-115905)

CVE-2026-115905 affects the zip crate in the Rust zip-rs/zip2 ecosystem. The vulnerability arises from differential parsing where ZipArchive relies on the Central Directory File Header (CDFH) for file metadata, while ZipStreamReader relies on the Local File Header (LFH). An attacker can craft a ZIP archive where the CDFH points to a benign file to bypass gateway security inspections, but the LFH directs the extraction to a sensitive path, resulting in an arbitrary file overwrite or potential RCE.

Attack Chain

1. Attacker crafts a malicious ZIP archive with mismatched CDFH and LFH filenames.
2. CDFH is configured to contain a benign filename (e.g., doc_report.pdf).
3. LFH is configured to contain a malicious path (e.g., /home/user/.ssh/authorized_keys or a system startup script).
4. The victim or a gateway security appliance inspects the ZIP archive using a parser that only validates the CDFH.
5. The security inspection concludes the archive is safe.
6. The target application uses ZipStreamReader to extract the archive.
7. The streaming extractor follows the LFH and overwrites a critical system or application file with attacker-controlled content.

Impact

Successful exploitation allows for arbitrary file overwrites, leading to potential Remote Code Execution (RCE) or security control bypass.

Recommendation

• Patch all projects using the Rust zip crate by updating the dependency to version 9.0.5 or newer.
• Audit existing infrastructure for applications that perform streaming extraction of user-supplied ZIP archives.
• Until patching is possible, implement validation logic that reconciles CDFH and LFH filenames before initiating extraction.
• Deploy the triage scanner provided by foxcornlab to audit Cargo.lock and suspicious ZIP archives for header mismatches.