CVE-2023-45853

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.

CVSS 3.1

9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

3.4% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-25)

CWE

CWE-190

Published

2023-10-14

Modified

2026-10-15

Record from

the NVD, synced 2026-10-19

Affected

• smihica:pyminizip
• zlib:zlib

Packages (OSV)

References

• http://www.openwall.com/lists/oss-security/2023/10/20/9
• http://www.openwall.com/lists/oss-security/2024/01/24/10
• https://chromium.googlesource.com/chromium/src/+/d709fb23806858847131027da95ef4c548813356
• https://chromium.googlesource.com/chromium/src/+/de29dd6c7151d3cd37cb4cf0036800ddfb1d8b61
• https://github.com/madler/zlib/blob/ac8f12c97d1afd9bafa9c710f827d40a407d3266/contrib/README.contrib#L1-L4

Check your stackJSON