SUSE zchunk Update Addresses Heap Out-of-Bounds Vulnerability

Linuxsecurity

SUSE zchunk Update Addresses Heap Out-of-Bounds Vulnerability

First seen 12 Nov 2026, 06:18 UTC • •51.0

Article Content

1 / 4

Browse articles

ThreatCluster •November 12, 2026 at 06:19 UTC

•CVE-2026-117556 allows application crashes via crafted `.zck` files.
•Patches were released on November 6, 2026, for affected SUSE products.
•The vulnerability has a CVSS score of 5.3, indicating medium severity.

A vulnerability, CVE-2026-117556, affecting the zchunk component in SUSE Linux systems has been patched. This flaw allows attackers to exploit a heap out-of-bounds read in the `read_preface()` function, potentially leading to application crashes via crafted `.zck` files. The vulnerability affects multiple SUSE products, including SUSE Linux Enterprise Server for SAP applications and openSUSE Leap 16.0. The issue was disclosed on October 27, 2026, and patches were released on November 6, 2026. Administrators are urged to apply the updates promptly to mitigate risks. The CVSS score for this vulnerability is rated at 5.3, indicating a medium severity level. There are currently no reports of in the wild.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 7h ago How this analysis works

Timeline

2026-10-27

CVE-2026-117556 published

SUSE disclosed a heap out-of-bounds read vulnerability affecting zchunk.

2026-11-06

Patches released for zchunk

SUSE released updates to fix CVE-2026-117556 for various Linux distributions.

More articles in this cluster (3)

Threat Graph

5 entities, 5 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (1)

Zero-day Exploit

Vulnerability (1)

CVE-2026-117556

Weakness (1)

CWE-125 - Out-of-bounds Read

Affected Platform (2)

Linux
SUSE Linux Enterprise Server

Relationships

CVE-2026-117556 targets Linux
CVE-2026-117556 targets SUSE Linux Enterprise Server
Zero-day Exploit targets Linux
Zero-day Exploit targets SUSE Linux Enterprise Server
CVE-2026-117556 related to CWE-125 - Out-of-bounds Read

Following this threat?

Track CVE-2026-117556 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

Which SUSE products are affected?

The vulnerability affects SUSE Linux Enterprise Server for SAP applications and openSUSE Leap 16.0.

What is the CVSS score of the vulnerability?

CVE-2026-117556 has a CVSS score of 5.3, indicating medium severity.

How should I apply the patches?

Use SUSE's recommended installation methods like YaST online_update or 'zypper patch' to apply the updates.

Continue Reading

Critical RCE Vulnerability in Confection WordPress Plugin (CVE-2026-115252) A critical vulnerability, CVE-2026-115252, has been identified in the Confection WordPress Cable plugin, affecting versions 0.4.0 to 0.4.7. This flaw allows unauthenticated attackers to execute arbitrary PHP code on the server by writing unmodified settings into a PHP file without proper checks. The vulnerability has…

Critical Code Injection Vulnerability in Staggs Plugin for WordPress A critical code injection vulnerability, CVE-2026-78287, has been identified in the Staggs plugin for WordPress, affecting versions up to 3.3.0. This flaw allows unauthenticated attackers to execute arbitrary code remotely, posing severe risks to affected sites. The vulnerability stems from improper control over code…