The vulnerability in IO::Uncompress::Unzip (CVE-2026-48959) arises from an inefficient algorithmic complexity issue (CWE-407) in the fastForward() function. Instead of comparing the offset itself, the function compares the digit count of the offset against the chunk size, causing the chunk size to reduce from 16 KiB to between 1 and 19 bytes per iteration. This leads to a per-byte read loop when extracting a named entry from a zip archive, which can be exploited by an attacker supplying a crafted zip file to cause CPU exhaustion. The impact scales with the compressed size of the entry, up to the 4 GiB limit of non-Zip64 archives. The vulnerability affects versions before 2.220. There is no CVSS score or vendor advisory confirming a patch or mitigation at this time.

The vulnerability can cause significant CPU resource exhaustion on systems using vulnerable versions of IO::Uncompress::Unzip when processing specially crafted zip files. This may lead to denial of service conditions due to high CPU consumption. There are no known exploits in the wild, and the impact is limited to CPU exhaustion rather than code execution or data corruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted zip files with IO::Uncompress::Unzip versions prior to 2.220. Monitor updates from the vendor PMQS for official patches or mitigations.