# CVE-2016-9844: Info-ZIP UnZip buffer overflow in zi_short function

Source: https://junglewise.ai/threats/cve-2016-9844-info-zip-unzip-buffer-overflow-in-zi-short-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-18. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2016-9844 · Severity: medium · CVSS 4 · Published 2017-01-18

A vulnerability in the Info-ZIP UnZip utility, a common tool for extracting compressed files, could allow an attacker to crash the application. By providing a specially crafted ZIP file with a large compression method value, an attacker can trigger a buffer overflow. This results in a denial-of-service condition where the tool fails to process the file and terminates unexpectedly.

Technologies: [Unzip Project Unzip](https://junglewise.ai/threats/technologies/unzip). Vendors: [Unzip Project](https://junglewise.ai/threats/vendors/unzip-project).

## Quick answers

**Is CVE-2016-9844 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-9844 being exploited in the wild.

**How severe is CVE-2016-9844?** Medium severity, with a CVSS score of 4, published 18 January 2017.

**Which products and versions are affected?** Info-ZIP UnZip 6.0.

**Is there a fix for CVE-2016-9844?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2016-9844 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2016-9844?** Check whether you run Unzip Project Unzip. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A buffer overflow exists in Info-ZIP UnZip 6.0 within the zi_short() function in zipinfo.c. The vulnerability is triggered when the two-byte compression method field in a ZIP file's central directory file header contains a value greater than 999. The code uses sprintf() to write this value into a 5-byte buffer (methbuf) starting at an offset of 1 byte. When the value is 1000 or greater, the resulting string (including the null terminator) exceeds the buffer bounds. This is a local attack vector requiring the victim to process a malicious ZIP file using the zipinfo tool. A fix was proposed for version 6.1e beta.

## Affected products

- Info-ZIP UnZip 6.0

## Timeline

- 2016-11-22: disclosed: Vulnerability reported to Ubuntu by Alexis Vanden Eijnde.
- 2016-12-05: other: CVE-2016-9844 assigned.
- 2017-01-18: advisory: NVD published the vulnerability.

## References

- [http://www.openwall.com/lists/oss-security/2016/12/05/13](http://www.openwall.com/lists/oss-security/2016/12/05/13)
- [http://www.openwall.com/lists/oss-security/2016/12/05/19](http://www.openwall.com/lists/oss-security/2016/12/05/19)
- [http://www.openwall.com/lists/oss-security/2016/12/05/20](http://www.openwall.com/lists/oss-security/2016/12/05/20)
- [http://www.securityfocus.com/bid/94728](http://www.securityfocus.com/bid/94728)
- [https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/1643750](https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/1643750)

## Related threats

- [Info-Zip UnZip buffer overflow in list_files](https://junglewise.ai/threats/cve-2014-9913-info-zip-unzip-buffer-overflow-in-list-files)