Is CVE-2025-15649 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-15649 being exploited in the wild.

How severe is CVE-2025-15649?

Informational severity, with a CVSS score of 0, published 27 May 2026.

Is there a fix for CVE-2025-15649?

A patch was published on 2025-10-25: Fix committed to GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-15649 attacked?

It is attacked with local access or over the network, in a software library.

Am I affected by CVE-2025-15649?

Check whether you run Perl CPAN IO-Compress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-15649: Perl IO::Uncompress::Unzip uncaught exception in DOS date parsing

CVE-2025-15649 · Severity: info · CVSS 0 · Published 2026-05-27

A vulnerability in a common Perl library used for handling ZIP files can cause applications to crash when processing a specially crafted archive. If an application uses this library to automatically process uploaded or external ZIP files, an attacker could provide a file with a malformed date header to trigger a denial-of-service state. This affects the reliability of services that rely on automated file decompression.

Technologies: Perl CPAN IO-Compress. Vendors: Perl CPAN.

Quick answers

Is CVE-2025-15649 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-15649 being exploited in the wild.
How severe is CVE-2025-15649?: Informational severity, with a CVSS score of 0, published 27 May 2026.
Which products and versions are affected?: Perl CPAN IO-Compress < 2.215.
Is there a fix for CVE-2025-15649?: A patch was published on 2025-10-25: Fix committed to GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-15649 attacked?: It is attacked with local access or over the network, in a software library.
Am I affected by CVE-2025-15649?: Check whether you run Perl CPAN IO-Compress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the `_dosToUnixTime()` function within `IO::Uncompress::Unzip`. The function decodes the last-modification date field from the local-file-header and passes the resulting values to `Time::Local::timelocal()` without an `eval` guard or input validation. If the ZIP header contains a date field that decodes to an out-of-range month, day, or hour, `timelocal()` throws an exception that propagates out of the `IO::Uncompress::Unzip->new()` constructor. This unexpected exception causes the calling Perl script to terminate (die) instead of returning an error code. The issue is resolved in version 2.215 by wrapping the call in an `eval` block.

Affected products

Perl CPAN IO-Compress (IO::Uncompress::Unzip) < 2.215

Timeline

2025-10-25: patched: Fix committed to GitHub repository
2026-01-31: advisory: Version 2.215 released on CPAN
2026-05-27: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.