Executive brief
A vulnerability in a common Perl library used for handling ZIP files can cause applications to crash when processing a specially crafted archive. If an application uses this library to automatically process uploaded or external ZIP files, an attacker could provide a file with a malformed date header to trigger a denial-of-service state. This affects the reliability of services that rely on automated file decompression.
Technical details
The vulnerability exists in the `_dosToUnixTime()` function within `IO::Uncompress::Unzip`. The function decodes the last-modification date field from the local-file-header and passes the resulting values to `Time::Local::timelocal()` without an `eval` guard or input validation. If the ZIP header contains a date field that decodes to an out-of-range month, day, or hour, `timelocal()` throws an exception that propagates out of the `IO::Uncompress::Unzip->new()` constructor. This unexpected exception causes the calling Perl script to terminate (die) instead of returning an error code. The issue is resolved in version 2.215 by wrapping the call in an `eval` block.
Affected products
- Perl CPAN IO-Compress (IO::Uncompress::Unzip) < 2.215
Timeline
- 2025-10-25: patched: Fix committed to GitHub repository
- 2026-01-31: advisory: Version 2.215 released on CPAN
- 2026-05-27: disclosed: CVE published to NVD