CVE-2014-8140: Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote at...

Security readout for executives and security teams

A crafted ZIP file can trigger a memory corruption flaw in Info-ZIP UnZip 6.0 and earlier when testing archives. If exploited, it may allow code execution on the system processing the file. Business risk is highest where untrusted ZIP files are automatically inspected or handled. Exposure is most likely on Linux or Unix systems, appliances, scripts, or services that still use Info-ZIP UnZip 6.0 or earlier, especially workflows that validate or process untrusted ZIP archives. Treat this as a high-priority legacy software risk if ZIP files enter business workflows. Prioritize systems that process external attachments or uploads, because successful exploitation could affect the processing host. Mitigation focus: Inventory hosts and services using Info-ZIP UnZip 6.0 or earlier.; Apply vendor or distribution security updates, including relevant Red Hat advisories where applicable.; Avoid processing untrusted ZIP files with vulnerable UnZip versions..

Prepared

Jun 6, 2026, 02:49 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.