CVE-2026-115905: Zip Cloaking in Rust, file overwrite

CVE-2026-115905 affects the zip library for Rust, widely used in applications handling compressed archives. The vulnerability is a critical mismatch: ZipArchive reads Central Directory File Header metadata while ZipStreamReader extracts using Local File Header data. A crafted archive can appear safe to directory inspection, but during extraction write to different paths and content, causing file overwrite.

The vulnerability scores CVSS 10.0, the maximum and critical rating. A patch is available in version 9.0.5 released after discovery. Public signals are limited: 3 social posts in the last 24 hours with 2 total interactions, indicating emerging but still low awareness consistent with the October 26, 2026 publication. No confirmed public exploit is reported.

For organizations: immediately verify if zip is in Rust dependencies using 'cargo tree' and 'cargo audit'. If present, update to 9.0.5 or later without delay. Short-term: restrict access to scripts and services extracting ZIP archives, especially those processing external uploads. Monitor file systems for unexpected overwrites.