EUVD-2026-32044
GHSA-hjrw-gmwj-xc9c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft ZIP with 0x7875 extra field
-
DeliverySet UID/GID Size byte to 8
-
ExploitDeliver archive to victim
-
ExecutionVictim runs zipdetails on file
-
Persistdecode_ux dispatches to missing unpackValueQ
-
ImpactPerl aborts with exit 255
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Exception handling procedures
|
| Exploitation Conditions | Requires the victim to invoke the zipdetails CLI tool bundled with IO::Compress 2.207-2.219 against an attacker-supplied ZIP archive that contains an Info-ZIP Unix Extra Field (tag 0x7875) with the UID Size or GID Size byte set to 8. Limiting factors: only the bin/zipdetails script is affected - Perl programs that import IO::Compress or IO::Uncompress as libraries cannot trigger the bug; user interaction is required to run the tool against the malicious file (despite the CVSS UI:N marking); and impact is limited to a process-level crash with exit code 255, not memory corruption, code execution, or data exposure. |
| Impact | Despite the NVD CVSS 3.1 score of 7.3 (AV:N/AC:L/PR:N/UI:N/C:L/I:L/A:L), the real-world risk is low. The Network attack vector and Low impact triad in the vector look misleading: the actual defect can only be triggered by manually running the zipdetails CLI against an attacker-supplied ZIP, so exploitation requires user interaction in practice and only the availability dimension is realistically affected (the script exits). This contradiction between the CVSS vector and the description should be noted - confidentiality and integrity impact are not substantiated by the patch or description, which only show a process abort. EPSS at 0.02% (4th percentile) and the absence of KEV listing or public exploit code align with the low practical risk. Tag is explicitly 'Denial Of Service' and the scope is a one-shot CLI crash, not a service outage. Priority for most environments: routine patching, not emergency. |
| Exploit ScenarioDerived | An attacker crafts a ZIP file containing an Info-ZIP New Unix Extra Field (0x7875) with the UID Size or GID Size byte set to 8 and supplies it to a victim who runs zipdetails for inspection - for example, an analyst triaging a suspicious archive or an automated pipeline that calls zipdetails to enumerate archive contents. The Perl interpreter aborts with 'Undefined subroutine &main::unpackValueQ' and exit status 255, preventing inspection of that and any subsequent archives in the same invocation. No public exploit identified at time of analysis, but the trigger is trivial to construct by hand. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 29, 2026
Denial of service in the zipdetails CLI tool bundled with Perl's IO::Compress versions 2.207 through 2.219 causes the script to abort with status 255 when parsing a ZIP archive containing an Info-ZIP Unix Extra Field (tag 0x7875) that declares an 8-byte UID or GID size. The bug is a typo in the source (calling unpackValueQ instead of unpackValue_Q), and no public exploit is identified at time of analysis; library callers of IO::Compress/IO::Uncompress are unaffected. EPSS is negligible (0.02%) and impact is limited to crashing the inspection tool, not the consuming application.
RemediationAI
Vendor-released patch: upgrade IO::Compress to version 2.220 or later from CPAN (https://metacpan.org/release/PMQS/IO-Compress-2.220/changes); the upstream commit is https://github.com/pmqs/IO-Compress/commit/33c89d03d6e746ed2ead4f2f6570d47864c61bc7 and was disclosed via oss-security at http://www.openwall.com/lists/oss-security/2026/05/27/3. If immediate upgrade is not possible, avoid running zipdetails against untrusted ZIP archives, or replace its use in any automation with an alternative ZIP inspector such as unzip -l or zipinfo; note that those alternatives produce different output and any scripts parsing zipdetails output will need adjustment. Library-only consumers of IO::Compress/IO::Uncompress need take no action.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IO::Compress is a widely distributed Perl distribution (cpe:2.3:a:pmqs:io::compress) that ships utility binaries alongside its compression libraries. The affected component is bin/zipdetails, a ZIP inspection tool. When parsing the Info-ZIP New Unix Extra Field (header tag 0x7875), the decode_ux() routine reads UID/GID size bytes and dispatches into decodeLitteEndian() (sic), which for 8-byte values calls unpackValueQ - a function that does not exist; the file defines unpackValue_Q with an underscore. Perl raises 'Undefined subroutine &main::unpackValueQ' at runtime. The root cause maps to CWE-755 (Improper Handling of Exceptional Conditions): the code did not validate the UID/GID size against a whitelist of supported widths, and the misnamed symbol was never exercised because no one previously tested an 8-byte UID extra field.
Know when Io gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
2DescriptionCVE.org
IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID.
When decode_ux() in bin/zipdetails handles an Info-ZIP Unix Extra Field (tag 0x7875) with UID Size or GID Size set to 8, causing zipdetails to decode an 8-byte UID or GID value, it dispatches through decodeLitteEndian(), which calls a misnamed helper unpackValueQ. The actual function defined in the same file is unpackValue_Q (with underscore); the call raises 'Undefined subroutine &main::unpackValueQ' and the script exits with status 255.
Library callers of IO::Compress and IO::Uncompress are not affected; the defect is in the bundled CLI tool.
Executive ViewAI
Perl's IO::Compress includes a denial-of-service vulnerability in the zipdetails CLI diagnostic tool that crashes when inspecting ZIP archives with specific malformed headers. The underlying library used by applications is unaffected; impact is limited to organizations relying on zipdetails for archive validation, inspection, or compliance scanning workflows.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
sbt is a build tool for Scala, Java, and others. Rated high severity (CVSS 7.1), this vulnerability is no authentication
Denial of service in the Perl module IO::Uncompress::Unzip before version 2.220 allows remote attackers to cause CPU exh
Uncaught exception in IO::Uncompress::Unzip before version 2.215 for Perl causes application-level denial of service whe
Exploit-DB