A tiny zip file that expands to petabytes
A zip bomb is a malicious archive file designed to crash systems. The most famous, named 42.zip, is incredibly tiny at just 42 kilobytes. However, it contains five layers of nested zip files. If fully extracted, the files expand to 4.5 petabytes of data—enough to completely overwhelm the hard drive and memory of almost any computer trying to scan or unpack it.
The Mechanism Behind Decompression Bombs
A zip bomb, sometimes referred to as a decompression bomb or a zip of death, is a malicious archive file designed not to hijack a system by executing unauthorized code, but to exhaust its computing resources until it crashes or freezes. Unlike conventional malware that relies on software vulnerabilities to install payloads, a zip bomb operates entirely within the valid rules of file archive formats. It abuses the basic mathematical principles of lossless data compression, taking advantage of how algorithms represent repetitive data in an extremely compact form.
The standard compression algorithm behind the ZIP format is DEFLATE, which replaces repeated strings and bit patterns with compact references. When an archive contains an extraordinarily uniform sequence of data—such as billions of consecutive null bytes or identical characters—DEFLATE can represent massive volumes of information using only a tiny fraction of storage. For a single layer of standard DEFLATE compression, the compression ratio typically maxes out at roughly 1032 to 1. While a single file compressed at this ratio is significant, attackers realized that combining compression with nested file structures could multiply these ratios exponentially.
When an automated program attempts to unpack or inspect such an archive, it begins allocating memory and writing uncompressed data to disk. Because the compressed file looks entirely benign and small on disk, the system cannot easily predict how much data will emerge during decompression without actively reading the headers or tracking the extraction process. If unconstrained, the extraction rapidly consumes available random-access memory, exhausts swap space, fills the hard drive, and overwhelms the central processing unit.