Decompression and Archive Extraction Vulnerabilities: A Taxonomy of 21 Attack Mechanisms Across 1,067 Public Cases (2001–2026)
This paper presents a unified taxonomy of 21 attack mechanisms and a labeled inventory of 1,067 public cases (2001–2026) to comprehensively classify decompression and archive-extraction vulnerabilities, revealing that path traversal dominates the landscape while highlighting significant gaps in mitigation documentation and offering new resources for future research.
Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Every day, software performs a quiet, essential act: it opens digital packages. Whether a user downloads a file, installs an application, or receives an email attachment, the computer must unpack compressed data to make it usable. This process, known as decompression, is the key that unlocks the contents of a digital archive. However, the mechanism that opens these packages can sometimes fail in dangerous ways. When an attacker sends a specially crafted file, the software might be tricked into creating a massive amount of data from a tiny input, crashing the system. It might be forced to write files to the wrong folders, overwriting critical system data. Or, the software might simply misunderstand the file's structure, leading to a breakdown. These failures are not rare glitches; they are a persistent class of security flaws that threaten everything from personal computers to the servers that run the internet.
A researcher named Eugen Spivak has spent years examining the public records of these failures to understand exactly how they happen. By looking at over a thousand documented cases of software vulnerabilities, Spivak created a new map of the problem. Instead of treating every error as a unique incident, the study groups them into twenty-one distinct attack methods. These methods fall into four main categories: situations where the output grows far larger than the input, errors where the software misreads the file's structure, failures where different parts of the system interpret the same file differently, and mistakes where the software saves files to the wrong location. The goal was to move beyond a scattered collection of individual bug reports and create a clear, unified picture of how these attacks work.
The study analyzed 1,067 public cases of these vulnerabilities, collected from official databases between 2001 and September 2026. The most striking finding is that the most common failure is not a complex mathematical trick or a deep memory error, but a simple mistake in where files are saved. In nearly 70 percent of the cases, the software extracted files into the wrong folder, allowing an attacker to overwrite important system files or plant malicious code. This specific type of error, often called "path traversal," happens when the software does not properly check the destination of a file before writing it. The research shows that this problem is most often found not in the core libraries that do the unpacking, but in the application code that uses those libraries. In other words, the tools themselves are often safe, but the programs that call the tools frequently forget to set the proper boundaries.
Another significant portion of the cases involves "decompression bombs." These are files designed to expand into something enormous, overwhelming the computer's memory or storage. The study found that in many of these instances, the software had a safety check in place, but the check was incomplete. It might have trusted a number declared inside the file itself, or it might have stopped checking after a certain point in the process. This means the defense existed but failed to cover every possible path the data could take. The research also noted a shift in how these attacks arrive. While many still come as files or packages, a growing number are now sent over the network as messages, targeting servers and online services directly.
Despite the frequency of these issues, the public records describing them are often vague. The study found that in only about 8 percent of the cases did the official report explicitly describe what the fix actually did. Most records simply stated that a new version of the software was available, without explaining the specific change that made it safe. This lack of detail makes it harder for security teams to understand the root cause and protect their systems. Furthermore, the study highlighted that the official records often miss a whole category of errors where two different software programs read the same file in conflicting ways. These "semantic gaps" are difficult to spot in public reports but are known to be a real threat in the field.
The data also revealed a sharp rise in the number of these reports in 2026. However, the researcher is careful to note that this increase reflects a change in how vulnerabilities are found and reported, rather than a sudden explosion in the number of attacks occurring in the wild. The rise could be due to better detection tools, changes in how reports are labeled, or a shift in terminology. What is certain is that the audited record shows a clear trend: the most common and dangerous failures are those where the software writes files to the wrong place, and these failures are most often the fault of the application code wrapping the extraction tools.
The study concludes with a set of practical recommendations for the people who build and maintain software. It suggests that library developers should clearly document what their tools do and do not protect against, and that application developers must take responsibility for checking where files are saved. It also calls for better reporting standards, urging that security advisories explicitly state what the fix does, rather than just pointing to a new version. By making these changes, the industry can move from a reactive stance of fixing individual bugs to a proactive approach of understanding and preventing the underlying mechanisms. The work does not claim to have solved the problem or to have tested every possible defense, but it provides the first comprehensive map of the terrain, showing exactly where the ground is most likely to give way.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.