CVE-2008-4779: TUGzip stack buffer overflow via long ZIP filename

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityThe CVSS 2.0 base score is 10.0 with a public exploit and very high EPSS, but exploitation requires the victim to open a crafted archive and the product is an older consumer archiver.

What it is

TUGzip 3.5.0.0 contains a stack-based buffer overflow (CWE-119) triggered by a long filename inside a .zip archive. Opening a crafted archive can crash the application or allow arbitrary code execution in the context of the user running TUGzip. The flaw matters because archive files are routinely exchanged and opened without suspicion, and the record gives no indication of a fixed version.

Impact

An attacker can cause a denial of service or execute arbitrary code with the privileges of the user who opens the malicious archive. Successful code execution gives full control of the affected host under that user account.

Attack surface

Reached remotely by delivering a crafted .zip file that the victim opens in TUGzip; the CVSS 2.0 vector AV:N/AC:L/Au:N indicates no authentication is required. Exploitation depends on user interaction, since the victim must open the archive.

Exploitation

Not listed in CISA KEV, but EPSS is 0.6469 (99.2nd percentile), indicating high predicted exploitation activity. A public Exploit-DB entry (6831) exists, so exploit code is publicly available.

What to do

• Upgrade TUGzip to a version later than 3.5.0.0 if one is available; the record does not name a fixed release, so verify with the vendor.
• If no fix exists, stop using TUGzip for untrusted archives and switch to a maintained archive tool.
• Block or quarantine .zip attachments at the mail and web gateways where operationally feasible.
• Train users not to open archives from unknown or unexpected senders.
• Where TUGzip must remain, run it with least privilege and isolate it from sensitive data.

Detection

• Monitor for TUGzip process crashes or abnormal termination when opening archives.
• Alert on TUGzip spawning child processes such as cmd.exe, powershell.exe or script hosts, which is not normal behavior.
• Scan incoming .zip files for excessively long filename entries before they reach endpoints.
• Hunt for TUGzip executions followed by unexpected outbound network connections or file writes outside normal archive extraction paths.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.