PeaZip CVE-2026-102514

Exploitation requires the victim to open or extract a crafted .pea archive containing a PCOMPRESS1 stream whose first block carries an oversized 32-bit compsize value; the vulnerable unpea_procedure in pea.pas reads this value without validation into the fixed-size wbuf1/wbuf2 global buffers. No archive password, integrity/authentication tag, or non-default configuration is required, and the affected builds ship without range checking, so default installations of PeaZip 11.2.0 and earlier are exploitable. The principal limiting factor is mandatory user interaction (UI:A) combined with a local attack vector (AV:L): the attacker cannot trigger the flaw remotely and must socially engineer the user into processing the malicious archive; impact is bounded to the privileges of the user running PeaZip.

This is a credible, actionable priority rather than a CVSS-inflated paper risk, but its real-world blast radius is constrained by the attack vector. The CVSS 4.0 vector is AV:L/AC:L/AT:N/PR:N/UI:A with VC:H/VI:H/VA:H (score 8.4), meaning exploitation is local and unauthenticated but requires the victim to actively open or extract a crafted .pea archive - classic client-side, social-engineering-dependent RCE. The technical quality of the bug is high: the first PCOMPRESS1 block's 32-bit compsize is read from the archive and used unvalidated as a blockread length into fixed 1,114,112-byte global buffers and as a copy bound, while the copy loop trusts the requested length over bytes actually read and terminates on equality, giving a clean controllable out-of-bounds write plus an attacker-chosen out-of-bounds read (wbuf1[compsize]). Because builds ship without range checking and no password or integrity tag is required, the primitive fires against default configurations. Code execution was demonstrated by two independent researchers on official Linux x86-64 and Windows x64 builds, which strongly corroborates exploitability, though this is researcher demonstration, not public weaponized exploit code. No EPSS score and no KEV status were supplied, and absence of KEV means there is no evidence of active in-the-wild exploitation; the independent confirmation plus low complexity suggests exploitation is plausible if targeting PeaZip users, but the mandatory user interaction and local vector argue for targeted phishing-style abuse rather than automatable mass exploitation.

An attacker crafts a malicious .pea archive whose first PCOMPRESS1 block declares an oversized 32-bit compsize, then delivers it via email, a download link, or a shared drive. When the victim opens or extracts the archive in PeaZip 11.2.0 or earlier, the unvalidated length overflows the global wbuf1/wbuf2 buffers and corrupts adjacent memory, yielding arbitrary code execution in the context of the user. Two independent researchers have already demonstrated working code execution against the official Linux x86-64 and Windows x64 builds.