CVE-2022-0529

A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.

Affected

unzip

CVSS v3.1 NVD

5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVSS v2.0 NVD

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P

EPSS

2.42% chance of exploitation in the next 30 days, 84th percentile

Published

2022-02-09

Updated

2026-10-08

Proof-of-concept exploits (2)

• ByteHackr/unzip_poc3★ · 2022-02-28
• nanaao/unzip_poc2★ · 2022-02-28

Security advisories

• https://bugzilla.redhat.com/show_bug.cgi?id=2051395
• https://lists.debian.org/debian-lts-announce/2022/09/msg00028.html
• https://security.gentoo.org/glsa/202310-17
• https://www.debian.org/security/2022/dsa-5202

References

• CVE Record
• NVD entry

Related

• CVE-2022-0530
• CVE-2022-0853
• CVE-2022-0996
• CVE-2023-38545
• CVE-2023-44487
• CVE-2021-29442