# CVE-2026-68924: MobSF ZIP/APK extraction denial of service via per-file size limit bypass

Source: https://junglewise.ai/threats/cve-2026-68924-mobsf-zip-apk-extraction-denial-of-service-via-per-file-size  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-68924 · Severity: medium · CVSS 4.9 · Published 2026-08-18

MobSF is a mobile application security testing framework that scans Android and iOS apps for vulnerabilities. When processing uploaded APK or ZIP files, it attempts to enforce a 400 MB limit per file to prevent disk exhaustion attacks. However, a missing control-flow statement causes the code to log a warning but extract the oversized file anyway, allowing attackers to exhaust disk space and block other users from conducting security scans. This can disrupt the availability of the scanning service and prevent legitimate security reviews.

Technologies: [mobsf (PyPI)](https://junglewise.ai/threats/technologies/mobsf). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-68924 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-68924 being exploited in the wild.

**How severe is CVE-2026-68924?** Medium severity, with a CVSS score of 4.9, published 18 August 2026.

**Which products and versions are affected?** mobsf (PyPI) < 4.5.1, ECOSYSTEM:introduced=0,fixed=4.5.1.

**Is there a fix for CVE-2026-68924?** Yes. mobsf (PyPI): upgrade to 4.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-68924 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-68924?** Check whether you run mobsf (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mobsf (PyPI): upgrade to 4.5.1 or later

  ```sh
  pip install "mobsf>=4.5.1"
  ```


## Technical details

The vulnerability exists in MobSF's ZIP/APK extraction logic in `shared_func.py` (lines 153–182). When a file within an archive exceeds the `ZIP_MAX_UNCOMPRESSED_FILE_SIZE` limit (400 MB), the code logs a warning message saying "Skipping" but fails to include a `continue` statement. This causes execution to fall through to the unconditional `zipptr.extract()` call at line 182, which extracts the oversized file to disk regardless of the size check. An attacker can craft a maliciously large APK containing highly compressible data (e.g., zeros) that will decompress to hundreds of MB when extracted, exhausting available disk space and rendering the scanning service unavailable to other users. This is a control-flow bypass affecting the per-file size enforcement mechanism; the separate total archive size check does not provide adequate protection. The vulnerability is fixed in version 4.5.1 by adding a `continue` statement to skip extraction of oversized files.

## Affected products

- MobSF Mobile Security Framework MobSF < 4.5.1

## Identifiers

- CVE-2026-68924
- GHSA-x768-8642-mmq9
- PYSEC-2026-3691

## Timeline

- 2026-07-05: disclosed: Published to GitHub Advisory Database
- 2026-08-18: patched: Version 4.5.1 released with fix
- 2026-08-18: advisory: GitHub reviewed and published GHSA-x768-8642-mmq9

## References

- [https://api.github.com/users/ya3raj](https://api.github.com/users/ya3raj)
- [https://github.com/ya3raj](https://github.com/ya3raj)
- [https://api.github.com/users/ya3raj/gists%7B/gist_id%7D](https://api.github.com/users/ya3raj/gists%7B/gist_id%7D)
- [https://api.github.com/users/ya3raj/repos](https://api.github.com/users/ya3raj/repos)
- [https://avatars.githubusercontent.com/u/59885197?v=4](https://avatars.githubusercontent.com/u/59885197?v=4)
- [https://api.github.com/users/ya3raj/events%7B/privacy%7D](https://api.github.com/users/ya3raj/events%7B/privacy%7D)

## Related threats

- [MobSF path traversal in icon analysis](https://junglewise.ai/threats/cve-2026-68922-mobsf-path-traversal-in-icon-analysis)
- [MobSF CSRF protection bypass after Django migration](https://junglewise.ai/threats/cve-2026-68923-mobsf-csrf-protection-bypass-after-django-migration)
- [MobSF SSRF port restriction bypass in assetlinks_check](https://junglewise.ai/threats/cve-2026-68927-mobsf-ssrf-port-restriction-bypass-in-assetlinks-check)
- [PYSEC-2026-2662 - MobSF has SQL Injection in its SQLite Database Viewer Utils](https://junglewise.ai/threats/cve-2026-33545-mobsf-has-sql-injection-in-its-sqlite-database-viewer-utils)
- [PYSEC-2026-1668 - MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field](https://junglewise.ai/threats/cve-2026-24490-mobsf-has-stored-xss-via-manifest-analysis-dialer-code-host-field)