PT-2026-43487 · Cpan · Io::Compress

Stig Palmquist · CVE-2026-48961 · Published 2026-05-27 · Updated 2026-07-24

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions IO::Compress versions 2.207 through 2.219

Description The bundled zipdetails CLI tool crashes when processing an Info-ZIP Unix Extra Field (tag 0x7875) where the UID Size or GID Size is set to 8. This occurs because the decode ux() function triggers decodeLitteEndian(), which attempts to call a misnamed helper function unpackValueQ. Since the actual function is defined as unpackValue Q, the script fails with an undefined subroutine error and exits. Library callers of IO::Compress and IO::Uncompress are not affected.

Recommendations Update to version 2.220.

Exploit

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2026-48961

ECHO-3BD6-6520-0759

OPENSUSE-SU-2026:10969-1

OPENSUSE-SU-2026:21177-1

Affected Products

Io::Compress

References · 29

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48961.json · Exploit
• https://github.com/pmqs/IO-Compress/commit/33c89d03d6e746ed2ead4f2f6570d47864c61bc7.patch · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-48961 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2026-48961 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-48961 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48961 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:21177-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10969-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-48961 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-48961 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2026-48961 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-13-CVE-2026-48961 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-48961 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-48961 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-48961 · Vendor Advisory