Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2016-9844

14
FAUCET Score

CVE-2016-9844 describes a buffer overflow vulnerability in the zi_short function of Info-Zip UnZip 6.0. An attacker can trigger a denial of service by providing a specially crafted ZIP archive with a large compression method value in the central directory file header. This vulnerability has a CVSS score of 4.0 (Medium), indicating a local attack vector with low complexity, resulting in a denial of service. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.

Impacted Technologies

VendorProductVersion(s)CPE
6.0CPE matchmatch criteria
cpe:2.3:a:unzip_project:unzip:6.0:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.0

4.0MEDIUM

CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
Exploitability Score
2.5
Impact Score
1.4
CvssVersion
3.0

Exploit Intelligence

EPSS Score
1.82%
Probability of exploitation in next 30 days
EPSS Percentile
76.5%
Percentile rank of EPSS score among Peer Group
As of 2026-07-24
Model: v2026.06.15
This CVE's current EPSS score of 0.0182 is in the 96th percentile among its peer group of 3,048 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (36)

microsoftpatch availablevia msrc
Product: unzip-6.0-20.azl3.aarch64.rpm on Azure Linux 3.0 ARMFixed in: 6.0-20
microsoftpatch availablevia msrc
Product: 18861-17084Fixed in: 6.0-20
microsoftpatch availablevia msrc
Product: 16846-16817Fixed in: 6.0-20
microsoftpatch availablevia msrc
Product: 16844-16820Fixed in: 6.0-15
microsoftpatch availablevia msrc
Product: 16845-16823Fixed in: 6.0-19
microsoftpatch availablevia msrc
Product: azl3 unzip 6.0-20 on Azure Linux 3.0Fixed in: 6.0-20
microsoftpatch availablevia msrc
Product: azl3 unzip 6.0-22 on Azure Linux 3.0Fixed in: 6.0-20
microsoftpatch availablevia msrc
Product: cm1 unzip 6.0-15 on CBL Mariner 1.0Fixed in: 6.0-15
microsoftpatch availablevia msrc
Product: cbl2 unzip 6.0-19 on CBL Mariner 2.0Fixed in: 6.0-19
microsoftpatch availablevia msrc
Product: unzip-debuginfo-6.0-19.cm2.aarch64.rpm on CBL Mariner 2.0 ARMFixed in: 6.0-19
microsoftpatch availablevia msrc
Product: unzip-6.0-20.azl3.x86_64.rpm on Azure Linux 3.0 x64Fixed in: 6.0-20
microsoftpatch availablevia msrc
Product: 16846-17084Fixed in: 6.0-20
microsoftpatch availablevia msrc
Product: CBL Mariner 1.0 x64Fixed in: 6.0-15
microsoftpatch availablevia msrc
Product: CBL Mariner 1.0 ARMFixed in: 6.0-15
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 x64Fixed in: 6.0-19
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 ARMFixed in: 6.0-19
microsoftpatch availablevia msrc
Product: 12837-12137Fixed in: 6.0-15
microsoftpatch availablevia msrc
Product: 12838-12137Fixed in: 6.0-15
microsoftpatch availablevia msrc
Product: 12839-12138Fixed in: 6.0-15
microsoftpatch availablevia msrc
Product: 12840-12138Fixed in: 6.0-15
microsoftpatch availablevia msrc
Product: 12841-12139Fixed in: 6.0-19
microsoftpatch availablevia msrc
Product: 12842-12139Fixed in: 6.0-19
microsoftpatch availablevia msrc
Product: 12843-12140Fixed in: 6.0-19
microsoftpatch availablevia msrc
Product: 12844-12140Fixed in: 6.0-19
microsoftpatch availablevia msrc
Product: 12845-12356Fixed in: 6.0-20
microsoftpatch availablevia msrc
Product: 12846-12357Fixed in: 6.0-20
microsoftpatch availablevia msrc
Product: unzip-6.0-15.cm1.x86_64.rpm on CBL Mariner 1.0 x64Fixed in: 6.0-15
microsoftpatch availablevia msrc
Product: unzip-debuginfo-6.0-15.cm1.x86_64.rpm on CBL Mariner 1.0 x64Fixed in: 6.0-15
microsoftpatch availablevia msrc
Product: unzip-6.0-15.cm1.aarch64.rpm on CBL Mariner 1.0 ARMFixed in: 6.0-15
microsoftpatch availablevia msrc
Product: unzip-debuginfo-6.0-15.cm1.aarch64.rpm on CBL Mariner 1.0 ARMFixed in: 6.0-15
microsoftpatch availablevia msrc
Product: unzip-6.0-19.cm2.x86_64.rpm on CBL Mariner 2.0 x64Fixed in: 6.0-19
microsoftpatch availablevia msrc
Product: unzip-debuginfo-6.0-19.cm2.x86_64.rpm on CBL Mariner 2.0 x64Fixed in: 6.0-19
microsoftpatch availablevia msrc
Product: unzip-6.0-19.cm2.aarch64.rpm on CBL Mariner 2.0 ARMFixed in: 6.0-19
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 5Fixed in: unzip
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: unzip
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: unzip

Vendor Advisories (4)

microsoft2024-Jun/CVE-2016-9844

CVE-2016-9844

Jun 11, 2024
microsoft2020-Aug/CVE-2016-9844

CVE-2016-9844

Aug 11, 2020
microsoft2017-Jan/CVE-2016-9844Moderate

Buffer overflow in the zi_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via a large compression method value in the central directory file header.

Jan 10, 2017
redhatCVE-2016-9844Low

unzip: methbuf[] buffer overflow in zipinfo's zi_short()

Dec 5, 2016

References

bugs.launchpad.net / ubuntu/+source/unzip/+bug/1643750
Issue Tracking
openwall.com / lists/oss-security/2016/12/05/13
Mailing ListThird Party Advisory
openwall.com / lists/oss-security/2016/12/05/19
Mailing ListThird Party Advisory
openwall.com / lists/oss-security/2016/12/05/20
Mailing ListThird Party Advisory
securityfocus.com / bid/94728
Third Party AdvisoryVDB Entry