CVE-2026-48961

HighCVSS 7.3

Published: 27/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

18th percentile - higher than 18% of all known CVEs

Summary

IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID. The defect is in the bundled CLI tool, not the library.

Risk Assessment

Using zipdetails on a crafted archive can cause the tool to crash, potentially leading to denial of service or data loss.

Recommendation

Upgrade IO::Compress to version 2.220 or later, which fixes the zipdetails tool.

Other vulnerabilities in IO::Compress

CVE-2026-48962High
Vulnerability in IO::Compress for Perl before version 2.220 allows arbitrary code execution via File::GlobMapper using an attacker-controlled output glob. The _parseOutputGlob() wraps the glob in quotes, and _getFiles() evaluates it via eval STRING, enabling Perl code injection.

Original NVD description (English source)

IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID. When decode_ux() in bin/zipdetails handles an Info-ZIP Unix Extra Field (tag 0x7875) with UID Size or GID Size set to 8, causing zipdetails to decode an 8-byte UID or GID value, it dispatches through decodeLitteEndian(), which calls a misnamed helper unpackValueQ. The actual function defined in the same file is unpackValue_Q (with underscore); the call raises 'Undefined subroutine &main::unpackValueQ' and the script exits with status 255. Library callers of IO::Compress and IO::Uncompress are not affected; the defect is in the bundled CLI tool.