ZIP is one of the oldest and most ubiquitous file formats in computing — nearly every compressed archive, Office document, Android APK, and Java JAR on your machine uses ZIP as its container. But a paper at USENIX Security 2025 found that the ZIP format specification itself contains significant ambiguities, allowing different ZIP parsers across programming languages to interpret the same file in different ways.
The Research
The researchers developed a differential fuzzer called ZipDiff and systematically tested 50 ZIP parsers covering 19 programming languages. The result: nearly every pair of parsers exhibits some kind of parsing ambiguity. They cataloged 14 types of parsing ambiguities, 10 of which are newly discovered.
Why This Matters
When a single ZIP file can be interpreted as two different contents by two different parsers, attackers gain a "semantic gap" between them. Real-world attack scenarios include:
- Bypassing secure email gateways: an attachment appears "safe" to the gateway's ZIP parser, but the user's mail client extracts different, malicious content
- Fooling VS Code extension signature verification: the extension package appears to pass signature checks, but actually loads unsigned malicious code
- Tampering with signed JAR files: Spring Boot's signature verification passes, while the code actually executed has been altered
Impact
Through these vulnerabilities, the paper earned bug bounties from Gmail, Coremail, and Zoho, as well as three CVEs (Go, LibreOffice, Spring Boot).
Core Insight
When multiple teams read the same "specification" and implement it independently, every ambiguity in that specification is a potential security vulnerability.
*Reference: "My ZIP Isn't Your ZIP" — USENIX Security 2025*