AIKIDO-2025-10347
SharpCompress is vulnerable to Out-of-Bounds Read
72
High Risk
This Affects:
SharpCompressTL;DR
Affected versions of this package are vulnerable to an out-of-bounds write due to insufficient validation of the nSelectors value parsed from untrusted input. An attacker can exploit this by crafting a malicious BZip2 file with excessively large nSelectors, causing the loop to write beyond the bounds of the selectorMtf array, potentially leading to memory corruption, crashes, or arbitrary code execution depending on runtime conditions.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
SharpCompress is vulnerable to Out-of-Bounds Read in versions 0.31.0 - 0.39.0.
How to fix this
Upgrade the SharpCompress library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant