The vulnerability arises because IO::Uncompress::Unzip improperly handles malformed DOS date fields in zip headers. Specifically, _dosToUnixTime() decodes the last-modification date and calls Time::Local::timelocal() without an eval guard, leading to an uncaught exception if the date is invalid. This causes the exception to propagate out of the constructor method where callers anticipate a controlled error return (undef plus $UnzipError), potentially disrupting normal error handling flows.

The impact is that malformed zip files with invalid DOS date fields can cause IO::Uncompress::Unzip to throw uncaught exceptions, potentially leading to application crashes or denial of service in software relying on this module. There is no indication of code execution or data corruption beyond the exception propagation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should validate or sanitize zip files before processing or implement their own exception handling around IO::Uncompress::Unzip->new calls to catch potential exceptions.