PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-48961 PMQS CVE debrief

A defect in the zipdetails CLI tool bundled with IO::Compress for Perl causes the utility to crash when processing ZIP archives containing Info-ZIP Unix Extra Fields (tag 0x7875) with 8-byte UID or GID values. The crash occurs due to a function name mismatch: decode_ux() calls unpackValueQ() but the actual defined function is unpackValue_Q() (with underscore), resulting in an undefined subroutine error and exit status 255. This affects versions 2.207 through 2.219; version 2.220 contains the fix. Library callers of IO::Compress and IO::Uncompress are not affected.

Vendor
PMQS
Product
IO::Compress
CVSS
HIGH 7.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-07-23
Advisory published
2026-05-27
Advisory updated
2026-07-23

Who should care

System administrators and security teams using zipdetails for ZIP archive analysis; Perl developers distributing or packaging IO::Compress; incident responders examining potentially malicious ZIP files that may trigger this crash condition

Technical summary

The zipdetails utility in IO::Compress versions 2.207-2.219 contains a typo in the decode_ux() function where it calls unpackValueQ() instead of the correctly named unpackValue_Q(). When processing a ZIP entry with Info-ZIP Unix Extra Field (0x7875) specifying 8-byte UID or GID sizes, the utility attempts to decode the value using the non-existent function, triggering a Perl runtime error and terminating with status 255. The underlying IO::Compress and IO::Uncompress Perl modules are unaffected; this is strictly a CLI tool defect.

Defensive priority

low

Recommended defensive actions

  • Upgrade IO::Compress to version 2.220 or later to obtain the corrected zipdetails utility
  • If immediate upgrade is not possible, avoid using zipdetails on untrusted ZIP archives that may contain Info-ZIP Unix Extra Fields with 8-byte UID/GID values
  • Note that this defect does not affect programmatic use of IO::Compress or IO::Uncompress modules; only the standalone zipdetails CLI tool is impacted

Evidence notes

The CVE description and NVD source data confirm the defect is isolated to the zipdetails CLI tool, not the underlying IO::Compress/IO::Uncompress libraries. The fix commit corrects the function name from unpackValueQ to unpackValue_Q. The CVSS score and severity are not yet assigned.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-48961 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-48961

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-48961 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-48961

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://github.com/pmqs/IO-Compress/commit/33c89d03d6e746ed2ead4f2f6570d47864c61bc7.patch

    9b29abf9-4ab0-4765-b253-1875cd9b441e

  • Source reference

    Unverified legacy reference

    URL: https://metacpan.org/release/PMQS/IO-Compress-2.220/changes

    9b29abf9-4ab0-4765-b253-1875cd9b441e

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.