CVE-2026-48961

A flaw was found in the zipdetails command-line interface (CLI) tool, bundled with IO::Compress for Perl. When processing a specially crafted Info-ZIP Unix Extra Field with an 8-byte User ID (UID) or Group ID (GID), the zipdetails tool attempts to call an undefined subroutine. This can lead to the tool crashing, resulting in a Denial of Service (DoS) for the user. This issue affects only the zipdetails CLI tool, not the IO::Compress library itself.

Exploitation requires a user to manually execute the bundled zipdetails command-line tool against a specially crafted zip file.

The flaw only causes the zipdetails script to crash, resulting in a localized Denial of Service, and does not affect the core IO::Compress and IO::Uncompress libraries. It does not lead to privilege escalation, data corruption, or broader system compromise.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid using the zipdetails tool on untrusted or unverified zip archives. If the zipdetails utility is not required, the perl-IO-Compress package can be removed to eliminate the vulnerability.