# CVE-2026-102514: PeaZip out-of-bounds write in PEA archive extraction

Source: https://junglewise.ai/threats/cve-2026-102514-out-of-bounds-write-cwe-787-in-the-pea-archive-extraction  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-01. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-102514 · Severity: info · Published 2026-10-01

PeaZip is a file archive manager used to open and extract compressed files. A flaw in the PEA archive format decompression allows an attacker to execute arbitrary code or crash the application when a victim opens a malicious .pea archive file. The vulnerability bypasses validation checks and overwrites memory with attacker-controlled data, potentially leading to full system compromise.

Technologies: [PeaZip](https://junglewise.ai/threats/technologies/peazip). Vendors: [PeaZip](https://junglewise.ai/threats/vendors/peazip).

## Quick answers

**Is CVE-2026-102514 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102514 being exploited in the wild.

**How severe is CVE-2026-102514?** Informational severity, published 1 October 2026.

**Which products and versions are affected?** PeaZip 11.2.0 and earlier.

**Is there a fix for CVE-2026-102514?** Yes: fixed in PeaZip 11.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-102514 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-102514?** Check whether you run PeaZip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in PeaZip 11.3.0

## Technical details

An out-of-bounds write (CWE-787) exists in the PCOMPRESS1 stream decompression routine (unpea_procedure in pea.pas) where the compressed block size from the first block is read and used without validation as both a buffer write length and array index. The 32-bit compsize field escapes the existing bounds check (which only validates subsequent blocks) and is used to overwrite fixed-size global buffers (wbuf1/wbuf2, 1,114,112 bytes each). The copy loop terminates on equality rather than an upper bound, amplifying the overflow impact. Code execution has been demonstrated on Windows x64 and Linux x86-64 builds; the application is built without range checking and requires no password, integrity verification, or special configuration.

## Affected products

- PeaZip PeaZip 11.2.0 and earlier

## Timeline

- 2026-10-01: disclosed
- 2026-09-26: patched: PeaZip 11.3.0 released with security fixes

## References

- [https://github.com/peazip/PeaZip/releases](https://github.com/peazip/PeaZip/releases)
- [https://github.com/peazip/PeaZip/commit/90ddbaee0945a4d8ffa4d972d43711bbfb9576ba](https://github.com/peazip/PeaZip/commit/90ddbaee0945a4d8ffa4d972d43711bbfb9576ba)

## Related threats

- [PeaZip incomplete dangerous-extension check in archive viewer](https://junglewise.ai/threats/cve-2026-104024-incomplete-list-of-disallowed-inputs-cwe-184-in-the-dangerous)
- [PeaZip path traversal in archive object viewer](https://junglewise.ai/threats/cve-2026-104025-path-traversal-cwe-22-in-the-execute-obj-function-of-the-archive)
- [PeaZip command injection via archive filename in non-default configuration](https://junglewise.ai/threats/cve-2026-105050-peazip-before-11-3-0-in-a-non-default-configuration-is)