CVE-2026-48961

Katalog CVE

CVSS 7.3 · High EPSS 0,41%

Kerentanan Improper Handling of Exceptional Conditions. Skor CVSS 3.1 7.3 (High) menurut CISA ADP.

Deskripsi (NVD)

IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID. When decode_ux() in bin/zipdetails handles an Info-ZIP Unix Extra Field (tag 0x7875) with UID Size or GID Size set to 8, causing zipdetails to decode an 8-byte UID or GID value, it dispatches through decodeLitteEndian(), which calls a misnamed helper unpackValueQ. The actual function defined in the same file is unpackValue_Q (with underscore); the call raises 'Undefined subroutine &main::unpackValueQ' and the script exits with status 255. Library callers of IO::Compress and IO::Uncompress are not affected; the defect is in the bundled CLI tool.

Rincian

Terbit di NVD

27 Mei 2026

Terakhir diubah

24 Juli 2026

Status NVD

Deferred

CVSS 3.1

7.3 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-755: Improper Handling of Exceptional Conditions

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/pmqs/IO-Compress/commit/33c89d03d6e746ed2ead4f2f6570d47864c61bc7.patch
• https://metacpan.org/release/PMQS/IO-Compress-2.220/changes
• http://www.openwall.com/lists/oss-security/2026/05/27/3