On March 10, 2026, security researcher Christopher Aziz of Bombadil Systems publicly disclosed CVE-2026-0866, a technique for crafting malformed ZIP archives that bypass nearly all antivirus and EDR scanning engines. CERT/CC issued advisory VU#976247 after coordinating with 30 vendors beginning in January 2026.
Technical Mechanism
The "Zombie ZIP" technique manipulates the ZIP local file header:
- Compression Method field: Set to
0x0000(STORED — no compression) - Actual payload data: DEFLATE-compressed (Method
0x08) - CRC-32 checksum: Calculated against the uncompressed payload, not the compressed data
When an AV scanner reads the header, it sees Method=0 and treats the file data as raw uncompressed bytes. Since the actual bytes are DEFLATE-compressed gibberish, no malware signatures match — the scanner returns a clean verdict.
Standard extraction tools (7-Zip, WinRAR, unzip, bsdtar, Python's zipfile module) also fail because the CRC-32 checksum does not match the compressed data they attempt to verify. However, a purpose-built loader that ignores the Method field and applies DEFLATE decompression directly recovers the original malicious payload intact.
Detection Results
When tested against 51 scanning engines on VirusTotal, only Kingsoft detected the malicious signatures — a 98% evasion success rate. The technique is related to CVE-2004-0935, a similar ZIP parsing vulnerability discovered over 20 years ago affecting an early ESET product.
Cisco acknowledged that ClamAV is "unable to scan this type of malformed ZIP file" but classified the issue as "a hardening suggestion" rather than a vulnerability, with no patch timeline announced.
Current Status
As of March 13, 2026, no vendor has released a patch. A proof-of-concept (including generator script and EICAR test samples) is available on GitHub at bombadil-systems/zombie-zip. No active exploitation campaigns have been documented, but the public availability of the PoC makes adoption by threat actors likely.
Defensive Guidance
Organisations should not rely solely on archive-level scanning. CERT/CC recommends implementing content-based analysis that validates compression method fields against actual data characteristics, rather than trusting header metadata at face value.