Collected research

My ZIP isn't your ZIP: Identifying and Exploiting Semantic Gaps Between ZIP Parsers

Yufan You, Jianjun Chen, Qi Wang and Haixin Duan · usenix.org

A differential fuzzer compared 50 ZIP parsers across 19 programming languages and found 14 classes of parsing ambiguity, 10 of them new. One crafted archive is read differently by two programs, letting an attacker slip content past secure email gateways, spoof document text, impersonate editor extensions, and alter signed nested archives that still pass verification.

Record

Researcher

Yufan You, Jianjun Chen, Qi Wang and Haixin Duan

Published by

usenix.org

Topic

Other

In the archive

• Collected in the 2025 research round

Related sources

• USENIX Security '25 - My ZIP isn't your ZIP: Identifying and Exploiting Semantic Gaps Between ZIP

Tags

• parser-differential
• filter-bypass
• supply-chain
• auth-bypass
• fuzzing
• spring
• java
• email
• cve
• owasp-a01-2021
• owasp-a05-2021
• owasp-a06-2021

This page is the archive's own catalogue record. The research is the work of Yufan You, Jianjun Chen, Qi Wang and Haixin Duan, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 19 August 2026.