CVE-2026-48961: CWE-755 Improper Handling of Exceptional Conditions in PMQS IO::Compress
IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID. When decode_ux() in bin/zipdetails handles an Info-ZIP Unix Extra Field (tag 0x7875) with UID Size or GID Size set to 8, causing zipdetails to decode an 8-byte UID or GID value, it dispatches through decodeLitteEndian(), which calls a misnamed helper unpackValueQ. The actual function defined in the same file is unpackValue_Q (with underscore); the call raises 'Undefined subroutine &main::unpackValueQ' and the script exits with status 255. Library callers of IO::Compress and IO::Uncompress are not affected; the defect is in the bundled CLI tool.
AI Analysis
Technical Summary
The vulnerability in IO::Compress versions 2.207 up to but not including 2.220 involves the zipdetails CLI tool crashing when handling Info-ZIP Unix Extra Fields (tag 0x7875) with UID or GID sizes set to 8 bytes. The crash is triggered by a call to an undefined subroutine 'unpackValueQ' instead of the correctly named 'unpackValue_Q' within the decode_ux() function. This results in the script terminating with exit status 255. Library users of IO::Compress and IO::Uncompress are not impacted by this defect, as it is isolated to the CLI tool.
Potential Impact
The impact is limited to denial of service of the zipdetails CLI tool when processing specially crafted zip files containing 8-byte UID or GID Info-ZIP Unix Extra Fields. This may disrupt workflows relying on this tool but does not affect the underlying IO::Compress or IO::Uncompress libraries, nor does it lead to code execution or data corruption. There are no known exploits in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — no official fix or patch is currently documented. Users should avoid using the zipdetails CLI tool on zip files containing 8-byte UID or GID Info-ZIP Unix Extra Fields until a fix is available. Since the vulnerability does not affect the IO::Compress or IO::Uncompress libraries, library users are not required to take action. Monitor the vendor or CPAN security advisories for updates and apply official patches once released.
CVE-2026-48961: CWE-755 Improper Handling of Exceptional Conditions in PMQS IO::Compress
Description
IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID. When decode_ux() in bin/zipdetails handles an Info-ZIP Unix Extra Field (tag 0x7875) with UID Size or GID Size set to 8, causing zipdetails to decode an 8-byte UID or GID value, it dispatches through decodeLitteEndian(), which calls a misnamed helper unpackValueQ. The actual function defined in the same file is unpackValue_Q (with underscore); the call raises 'Undefined subroutine &main::unpackValueQ' and the script exits with status 255. Library callers of IO::Compress and IO::Uncompress are not affected; the defect is in the bundled CLI tool.
CVSS v3.1
Score 7.3high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in IO::Compress versions 2.207 up to but not including 2.220 involves the zipdetails CLI tool crashing when handling Info-ZIP Unix Extra Fields (tag 0x7875) with UID or GID sizes set to 8 bytes. The crash is triggered by a call to an undefined subroutine 'unpackValueQ' instead of the correctly named 'unpackValue_Q' within the decode_ux() function. This results in the script terminating with exit status 255. Library users of IO::Compress and IO::Uncompress are not impacted by this defect, as it is isolated to the CLI tool.
Potential Impact
The impact is limited to denial of service of the zipdetails CLI tool when processing specially crafted zip files containing 8-byte UID or GID Info-ZIP Unix Extra Fields. This may disrupt workflows relying on this tool but does not affect the underlying IO::Compress or IO::Uncompress libraries, nor does it lead to code execution or data corruption. There are no known exploits in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — no official fix or patch is currently documented. Users should avoid using the zipdetails CLI tool on zip files containing 8-byte UID or GID Info-ZIP Unix Extra Fields until a fix is available. Since the vulnerability does not affect the IO::Compress or IO::Uncompress libraries, library users are not required to take action. Monitor the vendor or CPAN security advisories for updates and apply official patches once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CPANSec
- Date Reserved
- 2026-05-26T18:09:32.365Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a16660ce29bf47b50903589
Added to database: 05/27/2026, 03:33:32 UTC
Last enriched: 06/03/2026, 20:42:48 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 78
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.