Is CVE-2026-48961 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48961 being exploited in the wild.

How severe is CVE-2026-48961?

Informational severity, with a CVSS score of 0, published 27 May 2026.

Which products and versions are affected?

Perl CPAN IO-Compress 2.207 to 2.219.

Is there a fix for CVE-2026-48961?

A patch was published on 2026-05-16: Fixed in IO::Compress version 2.220 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48961 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-48961?

Check whether you run Perl CPAN IO-Compress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48961: Perl IO::Compress crash in zipdetails CLI tool

CVE-2026-48961 · Severity: info · CVSS 0 · Published 2026-05-27

A bundled command-line tool called zipdetails, which is used to display the internal structure of ZIP files, contains a software bug that causes it to crash when processing certain files. If the tool encounters a ZIP file containing specific Unix-style metadata (8-byte user or group IDs), it attempts to call a non-existent function and terminates abruptly. This issue only affects the standalone zipdetails utility and does not impact the security or stability of the core IO::Compress programming libraries used by other applications.

Technologies: Perl CPAN IO-Compress. Vendors: Perl CPAN.

Quick answers

Is CVE-2026-48961 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48961 being exploited in the wild.
How severe is CVE-2026-48961?: Informational severity, with a CVSS score of 0, published 27 May 2026.
Which products and versions are affected?: Perl CPAN IO-Compress 2.207 to 2.219.
Is there a fix for CVE-2026-48961?: A patch was published on 2026-05-16: Fixed in IO::Compress version 2.220 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48961 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-48961?: Check whether you run Perl CPAN IO-Compress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A denial-of-service (crash) exists in the zipdetails CLI tool bundled with IO::Compress. The vulnerability is caused by a typo in the decode_ux() function within bin/zipdetails; when handling an Info-ZIP Unix Extra Field (tag 0x7875) with a UID or GID size of 8 bytes, the code attempts to call 'unpackValueQ' instead of the correctly defined 'unpackValue_Q'. This results in an 'Undefined subroutine' error and a script exit status of 255. The issue is restricted to the CLI tool and does not affect the IO::Compress or IO::Uncompress Perl modules. The flaw is resolved in version 2.220 (zipdetails version 4.006).

Affected products

Perl CPAN IO::Compress 2.207 to 2.219

Timeline

2026-05-16: patched: Fixed in IO::Compress version 2.220
2026-05-27: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.