CVE-2008-0888 Use after free in unzip

Critical 9.3 Published 17 Mar 2008 Updated 26 Aug 2025

Remote attackers can trigger a use-after-free in unzip via crafted archives, potentially causing crashes or arbitrary code execution.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2008-0888?

CVE-2008-0888 is a critical use after free vulnerability in Apple Mac Os X, published on 17 Mar 2008. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The NEEDBITS macro in the inflate_dynamic function in inflate.c for unzip can be invoked using invalid buffers, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors that trigger a free of uninitialized or previously-freed data.

Weakness: CWE-119

Which versions are affected by CVE-2008-0888?

It affects 4 products.

Linux distribution packages (12)

`unzip` Red Hat:enterprise_linux:2.1::as	All versions	`0:5.50-31.EL2.1`
`unzip` Red Hat:enterprise_linux:2.1::aw	All versions	`0:5.50-31.EL2.1`
`unzip` Red Hat:enterprise_linux:2.1::es	All versions	`0:5.50-31.EL2.1`
`unzip` Red Hat:enterprise_linux:2.1::ws	All versions	`0:5.50-31.EL2.1`
`unzip` Red Hat:enterprise_linux:3::as	All versions	`0:5.50-36.EL3`
`unzip-debuginfo` Red Hat:enterprise_linux:3::as	All versions	`0:5.50-36.EL3`
`unzip` Red Hat:enterprise_linux:3::desktop	All versions	`0:5.50-36.EL3`
`unzip-debuginfo` Red Hat:enterprise_linux:3::desktop	All versions	`0:5.50-36.EL3`
`unzip` Red Hat:enterprise_linux:3::es	All versions	`0:5.50-36.EL3`
`unzip-debuginfo` Red Hat:enterprise_linux:3::es	All versions	`0:5.50-36.EL3`
`unzip` Red Hat:enterprise_linux:3::ws	All versions	`0:5.50-36.EL3`
`unzip-debuginfo` Red Hat:enterprise_linux:3::ws	All versions	`0:5.50-36.EL3`

Products include Apple Mac Os X, Canonical Ubuntu Linux, Debian Debian Linux, Unzip Project Unzip.

How do I fix CVE-2008-0888?

Apply the vendor's patch.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2008-0888 being exploited?

There is no known exploitation of CVE-2008-0888 in the wild and no public exploit code.

All Apple Mac Os X vulnerabilities

Sources

Also known as AZL-35330, AZL-6932, DEBIAN-CVE-2008-0888, DSA-1522-1, GHSA-q7mr-xjvc-chw3, RHSA-2008:0196.