CVE-2026-48961: Perl IO::Compress zipdetails DoS Vulnerability

CVE-2026-48961 Overview

CVE-2026-48961 affects the zipdetails command-line tool bundled with the Perl IO::Compress distribution, versions 2.207 through 2.219. The flaw is a missing function reference [CWE-755] inside bin/zipdetails. When the tool parses an Info-ZIP Unix Extra Field (tag 0x7875) containing an 8-byte UID or GID value, it calls a misnamed helper unpackValueQ that does not exist. The actual function defined in the file is unpackValue_Q. Perl raises Undefined subroutine &main::unpackValueQ and zipdetails exits with status 255. Library callers of IO::Compress and IO::Uncompress are not affected because the defect lives only in the bundled CLI utility.

Critical Impact

A crafted ZIP archive with an 8-byte UID or GID in the Info-ZIP Unix Extra Field crashes zipdetails during inspection, breaking forensic and automated archive-analysis workflows that depend on the tool.

Affected Products

• Perl IO::Compress distribution versions 2.207 through 2.219
• The zipdetails CLI tool shipped under bin/zipdetails
• Downstream OS packages repackaging affected IO::Compress releases

Discovery Timeline

• 2026-05-27 - CVE-2026-48961 published to NVD
• 2026-05-27 - Issue disclosed on the OpenWall oss-security mailing list
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-48961

Vulnerability Analysis

The defect is an unresolved subroutine reference in the zipdetails parser. When decode_ux() in bin/zipdetails processes an Info-ZIP Unix Extra Field (header tag 0x7875), it inspects the UID Size and GID Size bytes. If either size is set to 8, the field carries a 64-bit identifier. Decoding then routes through decodeLitteEndian(), which dispatches to a helper named unpackValueQ.

No such helper exists in the file. The function actually defined is unpackValue_Q, with an underscore separating the suffix. Perl resolves subroutine names at call time, so the typo is not surfaced until an archive with an 8-byte UID or GID is parsed. At that point the interpreter throws Undefined subroutine &main::unpackValueQ and the script terminates with exit code 255. The vulnerability is classified as Improper Check for Unusual or Exceptional Conditions [CWE-755] and results in a denial-of-service condition limited to the CLI utility.

Root Cause

The root cause is a naming inconsistency between caller and callee. decodeLitteEndian() in bin/zipdetails invokes unpackValueQ, but the implementation is named unpackValue_Q. The 4-byte UID/GID path uses a separately named helper and therefore parses correctly. The 8-byte path was never exercised by the test suite, so the typo persisted from release 2.207 through 2.219.

Attack Vector

An attacker supplies a ZIP archive containing an Info-ZIP Unix Extra Field with UID Size or GID Size set to 8. When an analyst or automated pipeline runs zipdetails against the file, the script aborts. The impact is confined to the CLI: library workflows using IO::Compress or IO::Uncompress modules continue to function. There is no code execution or memory corruption. The vulnerability disrupts archive inspection, which can hinder incident response and malware triage when adversaries deliberately craft archives to break analysis tooling.

No verified exploitation code is available. The crash is reproducible by constructing a minimal ZIP entry whose extra-field block carries tag 0x7875 with the UID or GID size byte set to 0x08 and an 8-byte identifier payload, then invoking zipdetails against the file. See the GitHub patch commit for the exact code path.

Detection Methods for CVE-2026-48961

Indicators of Compromise

• zipdetails process exits with status 255 and emits Undefined subroutine &main::unpackValueQ to standard error
• ZIP archives containing an Info-ZIP Unix Extra Field (tag 0x7875) where the UID Size or GID Size byte equals 0x08
• Repeated zipdetails failures in automated archive-analysis or CI pipelines processing untrusted ZIP files

Detection Strategies

• Inventory hosts running Perl IO::Compress2.207 through 2.219 using package managers (cpan -l, dpkg -l, rpm -qa) and CPAN module version checks
• Inspect ZIP archives for the 0x7875 extra-field tag and flag entries declaring 8-byte UID or GID sizes prior to invocation of zipdetails
• Monitor analyst workstations and sandbox runners for zipdetails non-zero exit codes correlated with ZIP file inputs

Monitoring Recommendations

• Capture stderr from forensic tooling and alert on the literal string Undefined subroutine &main::unpackValueQ
• Log the version of IO::Compress in use across analysis pipelines and trigger remediation when versions fall in the affected range
• Track ZIP archive metadata anomalies in upload and email-attachment paths feeding analysis workflows

How to Mitigate CVE-2026-48961

Immediate Actions Required

• Upgrade IO::Compress to version 2.220 or later from CPAN or the relevant distribution repository
• Identify all systems running affected versions, including analyst workstations, sandboxes, and CI workers that call zipdetails
• Wrap zipdetails invocations in automation with error handling so a crash does not silently skip archive inspection

Patch Information

The maintainer fixed the typo in bin/zipdetails by aligning the caller in decodeLitteEndian() with the defined helper unpackValue_Q. The fix is included in IO::Compress2.220. See the GitHub patch commit, the MetaCPAN release changes, and the OpenWall oss-security post for full technical context.

Workarounds

• Pre-filter ZIP archives and reject or repair entries whose Info-ZIP Unix Extra Field (0x7875) declares an 8-byte UID or GID before passing to zipdetails
• Use alternative ZIP inspection tools such as unzip -lv or zipinfo until the patched version is deployed
• Pin Perl environments to IO::Compress2.220 or later in dependency manifests and container base images

# Configuration example
# Upgrade IO::Compress to the patched release
cpan IO::Compress

# Verify the installed version is 2.220 or later
perl -MIO::Compress -e 'print "$IO::Compress::VERSION\n"'

# Confirm the patched helper name is present in bin/zipdetails
grep -n 'unpackValue_Q' "$(which zipdetails)"