sec: RUSTSEC-2026-0429, a zip archive that aborts the process on extract #574
2026-11-02
sec: RUSTSEC-2026-0429, a zip archive that aborts the process on extract
All checks were successful
wai-quantum WebGPU member / member · browser WebGPU (macos) (pull_request) Successful in 1m33s
wai-ops-gpu integer operators on GPUs / Metal GPU and browser WebGPU (macos) (pull_request) Successful in 7m46s
wai-quantum WebGPU member / member · software Vulkan (linux) (pull_request) Successful in 2m46s
wai-quantum studio and desktop / desktop app · macos (pull_request) Successful in 6m50s
wai-quantum WebGPU member / shader checks · browser build · wasip2 inertness · MSRV (pull_request) Successful in 4m10s
joule-moq-web browser client / joule-moq-web · browser end-to-end (macos) (pull_request) Successful in 22m30s
WAI mbt2018_mean integer decode (regenerated vectors) / regenerate mbt2018_mean integer vectors → Rust decode, required (pull_request) Successful in 5m40s
wai-quantum studio and desktop / desktop app · linux (pull_request) Successful in 6m24s
wai-quantum studio and desktop / desktop app · windows (pull_request) Successful in 10m59s
wai-web wasm32 / wai-web wasm32 build · corpus, menu and writers (pull_request) Successful in 5m57s
wai-sink-android native sink library / every ABI, the AAR, and the instrumented tests in a headless emulator · macos (pull_request) Successful in 9m10s
wai-quantum docs, course and locales / every command and snippet in the docs · linux (pull_request) Successful in 16m9s
wai-quantum WebGPU member / member · GPU, Vulkan (jetson-hub) (pull_request) Successful in 25m5s
WAI Studio / Studio in Chromium and Firefox · macos (pull_request) Successful in 7m37s
wai-quantum WebGPU member / member · GPU, Vulkan (thor) (pull_request) Successful in 25m12s
WAI conformance / cargo-class corpora · linux-arm64 (pull_request) Successful in 23m18s
WAI conformance / delivery telemetry · CMCD and CMSD against an independent library (pull_request) Successful in 12s
WAI conformance / each feature of the independent verifiers' steps compiles alone (pull_request) Successful in 15m57s
WAI conformance / cross-arch byte-equality · linux-arm64 (pull_request) Successful in 35s
WAI Studio / Studio in WebKit · linux (pull_request) Successful in 10m44s
WAI conformance / C2PA manifest emission · signed, read back, validated (pull_request) Successful in 2m3s
wai-sink-swift native sink package / libwai slices, desktop tests, simulator tests · macos (pull_request) Successful in 11m36s
WAI examples / WAI examples · android-app · linux-arm64 (pull_request) Successful in 7m25s
wai-pack / wai-pack · linux-arm64 (pull_request) Successful in 3m3s
WAI energy receipts / energy receipts · linux-arm64 (pull_request) Successful in 16m37s
wai-pack / wai-pack · the floor through a media prober (pull_request) Successful in 36s
wai-pack / wai-pack · dependency licences (pull_request) Successful in 1m43s
wai-pack / wai-pack · independent verifier (Python) (pull_request) Successful in 9m21s
wai-sink-android native sink library / the JNI layer and the platform-free half on the host JVM · linux-arm64 (pull_request) Successful in 3m24s
WAI conformance / independent verifiers · claims, JWP, key discovery and integer payloads (Python) (pull_request) Successful in 1h22m6s
`ZipArchive::extract` sizes a symlink target's buffer from the size the
archive declares, so a 112-byte archive aborts the process. Fixed in zip 9.
The audit went red on every open PR when the advisory was published.
Two lockfiles move:
wai-quantum-desktop: tauri-plugin-updater 2.14.0 -> 2.14.1. Its source is
unchanged; it asks for zip 9. This was the only copy that runs `extract`
in a shipped program, on Windows, on an update package whose signature
has already been checked.
wai-rs: c2pa 0.90 -> 0.91, behind `c2pa_emit`. This also takes
elliptic-curve 0.14, so the workspace holds no crypto-bigint 0.5.
Four copies stay, each read at its call site and allowed at its exact
version: open_board_format and candle-core never call `extract`, and
webrtc-sys-build calls it in a build script, on its own download. The build
crate's next releases change which libwebrtc it downloads, so it moves with
livekit.
The comment over the older zip entries said nothing in this tree extracts an
archive. It was wrong: the updater did, and the build script does. It now
says what is true.
Co-Authored-By: Claude Opus 5.5 <[email protected]>