CVE-2026-48961
Description
A flaw was found in the zipdetails command-line interface (CLI) tool, bundled with IO::Compress for Perl. When processing a specially crafted Info-ZIP Unix Extra Field with an 8-byte User ID (UID) or Group ID (GID), the zipdetails tool attempts to call an undefined subroutine. This can lead to the tool crashing, resulting in a Denial of Service (DoS) for the user. This issue affects only the zipdetails CLI tool, not the IO::Compress library itself.
Statement
Exploitation requires a user to manually execute the bundled zipdetails command-line tool against a specially crafted zip file.
The flaw only causes the zipdetails script to crash, resulting in a localized Denial of Service, and does not affect the core IO::Compress and IO::Uncompress libraries. It does not lead to privilege escalation, data corruption, or broader system compromise.
Mitigation
To mitigate this issue, avoid using the `zipdetails` tool on untrusted or unverified zip archives. If the `zipdetails` utility is not required, the `perl-IO-Compress` package can be removed to eliminate the vulnerability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5 | N/A | 7.3 |
| Attack Vector | Local | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | Required | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | Low |
| Integrity Impact | None | N/A | Low |
| Availability Impact | High | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Understanding the Weakness (CWE)
Other
Technical Impact: Quality Degradation; Varies by Context
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
