CVE-2024-39134 Overview
CVE-2024-39134 is a stack buffer overflow vulnerability in zziplib version 0.13.77, a library that provides read access to ZIP archives. The flaw resides in the __zzip_fetch_disk_trailer() function within /zzip/zip.c. Attackers can trigger the overflow by supplying a crafted ZIP archive, causing the parser to write beyond the bounds of a stack-allocated buffer. Successful exploitation results in a denial of service against any application or service that uses zziplib to process untrusted archives. The vulnerability is classified under CWE-120: Buffer Copy without Checking Size of Input.
Critical Impact
Remote attackers can crash applications that parse untrusted ZIP archives with zziplib 0.13.77, with no authentication or user interaction required.
Affected Products
- gdraheim zziplib 0.13.77
- Applications statically linking the vulnerable zziplib build
- Linux distributions and packages bundling zziplib 0.13.77
Discovery Timeline
- 2024-06-27 - CVE-2024-39134 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-39134
Vulnerability Analysis
The defect lives in __zzip_fetch_disk_trailer(), the routine responsible for locating and parsing the End of Central Directory (EOCD) record at the tail of a ZIP archive. The function reads trailer data into a fixed-size stack buffer without sufficient validation of the input length or offsets derived from the archive. A crafted archive can drive the function to copy more bytes than the destination buffer can hold, corrupting adjacent stack memory.
The immediate observable effect is process termination through a segmentation fault or stack canary abort. The Common Vulnerability Scoring System (CVSS) vector indicates a network-reachable attack with low complexity and no privileges, impacting availability only. The Exploit Prediction Scoring System (EPSS) score is 0.604% at the 44.471 percentile. No public proof-of-concept or in-the-wild exploitation has been reported.
Root Cause
The root cause is missing bounds enforcement when __zzip_fetch_disk_trailer() copies trailer bytes from the input archive into a local stack buffer. Length values parsed from attacker-controlled fields are trusted without validation against the destination buffer size, violating safe memory handling practices required by [CWE-120].
Attack Vector
An attacker delivers a malformed ZIP archive to any service, utility, or application that calls into zziplib 0.13.77 to enumerate or extract archive contents. Common delivery channels include file upload endpoints, email attachments, package managers, and document processors that internally rely on zziplib. Parsing the archive triggers the overflow and crashes the host process.
No verified exploitation code is publicly available. The vulnerability mechanism is described in the upstream GitHub issue tracker.
Detection Methods for CVE-2024-39134
Indicators of Compromise
- Unexpected crashes or segmentation faults in processes that handle ZIP archives, with stack traces referencing __zzip_fetch_disk_trailer or zzip/zip.c.
- Core dumps generated immediately after ingestion of an attacker-supplied archive.
- Repeated restarts of services that accept user-uploaded compressed files.
Detection Strategies
- Inventory installed packages and identify hosts running zziplib 0.13.77 using package managers such as dpkg -l zziplib or rpm -q zziplib.
- Scan source trees and container images for the vulnerable version string and the __zzip_fetch_disk_trailer symbol.
- Inspect application logs for abnormal termination signals (SIGSEGV, SIGABRT) correlated with ZIP file processing.
Monitoring Recommendations
- Forward process crash telemetry and signal exit codes to a centralized logging or SIEM platform for correlation.
- Alert on parsing failures or repeated archive submission attempts originating from a single source.
- Track file upload endpoints for anomalous archive sizes or malformed EOCD records.
How to Mitigate CVE-2024-39134
Immediate Actions Required
- Upgrade zziplib to a version released after 0.13.77 once the upstream maintainer publishes a fixed build.
- Restrict untrusted ZIP archive ingestion in services that link against the vulnerable library.
- Run archive parsing in sandboxed or least-privilege processes that can crash safely without disrupting the host service.
Patch Information
No official patched release has been linked in the NVD entry at the time of writing. Track remediation progress on the upstream zziplib issue #165 and rebuild dependent packages once a fixed version is published.
Workarounds
- Validate ZIP archives with a hardened parser before passing them to zziplib, rejecting files with malformed or oversized EOCD records.
- Apply operating system hardening such as stack canaries, Address Space Layout Randomization (ASLR), and FORTIFY_SOURCE to limit crash impact.
- Isolate archive-processing workloads inside containers or seccomp-restricted processes to contain denial-of-service effects.
# Identify vulnerable zziplib installations on Linux hosts
dpkg -l | grep -i zziplib
rpm -qa | grep -i zziplib
find / -name 'libzzip*' -exec strings {} \; | grep -i '0.13.77'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
