# CVE-2026-48961: Perl IO::Compress crash in zipdetails CLI tool

Source: https://junglewise.ai/threats/cve-2026-48961-perl-io-compress-crash-in-zipdetails-cli-tool  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2026-48961 · Severity: info · CVSS 0 · Published 2026-05-27

A bundled command-line tool called zipdetails, which is used to display the internal structure of ZIP files, contains a software bug that causes it to crash when processing certain files. If the tool encounters a ZIP file containing specific Unix-style metadata (8-byte user or group IDs), it attempts to call a non-existent function and terminates abruptly. This issue only affects the standalone zipdetails utility and does not impact the security or stability of the core IO::Compress programming libraries used by other applications.

Technologies: [Perl CPAN IO-Compress](https://junglewise.ai/threats/technologies/io-compress). Vendors: [Perl CPAN](https://junglewise.ai/threats/vendors/perl-cpan).

## Quick answers

**Is CVE-2026-48961 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48961 being exploited in the wild.

**How severe is CVE-2026-48961?** Informational severity, with a CVSS score of 0, published 27 May 2026.

**Which products and versions are affected?** Perl CPAN IO-Compress 2.207 to 2.219.

**Is there a fix for CVE-2026-48961?** A patch was published on 2026-05-16: Fixed in IO::Compress version 2.220 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48961 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-48961?** Check whether you run Perl CPAN IO-Compress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A denial-of-service (crash) exists in the zipdetails CLI tool bundled with IO::Compress. The vulnerability is caused by a typo in the decode_ux() function within bin/zipdetails; when handling an Info-ZIP Unix Extra Field (tag 0x7875) with a UID or GID size of 8 bytes, the code attempts to call 'unpackValueQ' instead of the correctly defined 'unpackValue_Q'. This results in an 'Undefined subroutine' error and a script exit status of 255. The issue is restricted to the CLI tool and does not affect the IO::Compress or IO::Uncompress Perl modules. The flaw is resolved in version 2.220 (zipdetails version 4.006).

## Affected products

- Perl CPAN IO::Compress 2.207 to 2.219

## Timeline

- 2026-05-16: patched: Fixed in IO::Compress version 2.220
- 2026-05-27: disclosed: CVE published to NVD

## References

- [https://github.com/pmqs/IO-Compress/commit/33c89d03d6e746ed2ead4f2f6570d47864c61bc7.patch](https://github.com/pmqs/IO-Compress/commit/33c89d03d6e746ed2ead4f2f6570d47864c61bc7.patch)
- [https://metacpan.org/release/PMQS/IO-Compress-2.220/changes](https://metacpan.org/release/PMQS/IO-Compress-2.220/changes)

## Related threats

- [Perl IO::Uncompress::Unzip uncaught exception in DOS date parsing](https://junglewise.ai/threats/cve-2025-15649-perl-io-uncompress-unzip-uncaught-exception-in-dos-date-parsing)