Quick answers
- Is CVE-2026-102514 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-102514 being exploited in the wild.
- How severe is CVE-2026-102514?
- Informational severity, published 1 October 2026.
- Which products and versions are affected?
- PeaZip 11.2.0 and earlier.
- Is there a fix for CVE-2026-102514?
- Yes: fixed in PeaZip 11.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-102514 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-102514?
- Check whether you run PeaZip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: PeaZip 11.3.0
Technical details
An out-of-bounds write (CWE-787) exists in the PCOMPRESS1 stream decompression routine (unpea_procedure in pea.pas) where the compressed block size from the first block is read and used without validation as both a buffer write length and array index. The 32-bit compsize field escapes the existing bounds check (which only validates subsequent blocks) and is used to overwrite fixed-size global buffers (wbuf1/wbuf2, 1,114,112 bytes each). The copy loop terminates on equality rather than an upper bound, amplifying the overflow impact. Code execution has been demonstrated on Windows x64 and Linux x86-64 builds; the application is built without range checking and requires no password, integrity verification, or special configuration.
Affected products
- PeaZip PeaZip 11.2.0 and earlier
Timeline
- 2026-10-01: disclosed
- 2026-09-26: patched: PeaZip 11.3.0 released with security fixes