{"id":11282,"date":"2026-03-12T04:04:00","date_gmt":"2026-03-12T04:04:00","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/03\/12\/32786\/"},"modified":"2026-03-12T04:04:00","modified_gmt":"2026-03-12T04:04:00","slug":"32786","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/03\/12\/32786\/","title":{"rendered":"Analyzing “Zombie Zip” Files (CVE-2026-0866), (Wed, Mar 11th)"},"content":{"rendered":"\n
Analyzing “Zombie Zip” Files (CVE-2026-0866), (Wed, Mar 11th)<\/div>\n

\t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A new vulnerability\u00a0(CVE-2026-0866) has been published<\/a>: Zombie Zip<\/a>.<\/p>\n

It’s a method to create a malformed ZIP file that will bypass detection by most anti-virus engines.<\/p>\n

The malformed ZIP file can not be opened with a ZIP utility, a custom loader is required.<\/p>\n

The trick is to change the compression method to STORED while the contend is still DEFLATED: a flag in the ZIP file header states the content is not compressed, while in reality, the content is compressed.<\/p>\n

I will show you how to use my tools to analyze such a malformed ZIP file.<\/p>\n

Simple Method<\/u><\/p>\n

Just run my tool search-for-compression.py<\/a> on the ZIP file (you can download the Zombie ZIP file here<\/a>, it contains an EICAR<\/a> file):<\/p>\n

\"\"<\/p>\n

The largest compression blob is number 2, it is 77 bytes long. Let’s select it:<\/p>\n

\"\"<\/p>\n

That’s the EICAR<\/a> file.<\/p>\n

Complex Method<\/u><\/p>\n

We can use the latest version of zipdump.py<\/a> to analyze the file:<\/p>\n

Just using the tool fails (because the zip file is malformed):<\/p>\n

\"\"<\/p>\n

Using option -f to bypass the Python ZIP library for parsing, and using custom code to look for ZIP records (-f l) shows us this is a ZIP file, containing a file with the name eicar.com:<\/p>\n

\"\"<\/p>\n

Selecting the FILE record (at position 0x00000000, PK0304 fil) shows us all the meta data:<\/p>\n

\"\"<\/p>\n

The compressiontype is 0 (STORED), this means that the content of the file is just stored inside the ZIP file, not compressed.<\/p>\n

But notice that the compressedsize and uncompressedsize are different (70 and 68). It should be the same for a STORED file.<\/p>\n

Let’s select the raw file content (-s data) and perform an asciidump (-a):<\/p>\n

\"\"<\/p>\n

This does not look like the EICAR file.<\/p>\n

Let’s force the decompression of the data: -s forcedecompress:<\/p>\n

\"\"<\/p>\n

This reveals the EICAR file content.<\/p>\n

Option forcedecompress is a new option that I just coded in zipdump.py<\/a> version 0.0.35. Option decompress will only decompress if the compression type is DEFLATED, thus it can’t be used on this malformed ZIP file. Option forcedecompress will always try to decompress (and potentially fail), regardless of the compression type.<\/p>\n

\u00a0<\/p>\n

Didier Stevens
\nSenior handler
\nblog.DidierStevens.com<\/a><\/p>\n

(c) SANS Internet Storm Center. https:\/\/isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.<\/p><\/div>\n

\t

\n
<\/BR><\/p>\n

\t

\n
<\/BR>
\nGo to isc.sans.edu<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Analyzing “Zombie Zip” Files (CVE-2026-0866), (Wed, Mar 11th) A new vulnerability\u00a0(CVE-2026-0866) has been published: Zombie Zip. It’s a method to create a malformed ZIP file that will bypass detection by most anti-virus engines. The malformed ZIP file can not be opened with a ZIP utility, a custom loader is required. The trick is to change […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[56],"tags":[69],"class_list":["post-11282","post","type-post","status-publish","format-standard","hentry","category-isc-sans-edu","tag-isc-sans-edu"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/11282"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=11282"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/11282\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=11282"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=11282"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=11282"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}