CVE-2026-48961

What it actually does

CVE-2026-48961 is a denial-of-service flaw in the zipdetails command-line tool bundled with Perl IO::Compress versions 2.207 through versions before 2.220. When zipdetails parses a ZIP archive containing an Info-ZIP Unix Extra Field with tag 0x7875 and a UID Size or GID Size of 8 bytes, the code path calls a misspelled helper function, unpackValueQ, instead of the defined unpackValue_Q function. This results in an “Undefined subroutine &main::unpackValueQ” runtime error and terminates the zipdetails process with exit status 255. The defect affects the CLI analysis tool, not normal IO::Compress or IO::Uncompress library callers.

Why it matters to the business

The main operational risk is disruption of workflows that automatically inspect, validate, triage, or extract metadata from ZIP files using zipdetails. A crafted archive can cause those jobs to fail, potentially interrupting malware analysis pipelines, file-ingestion checks, software supply-chain review processes, or automated archive metadata reporting. Because this is not listed in CISA KEV, is not known to be used in ransomware campaigns, has low EPSS likelihood, and has no reported public exploit maturity, urgency is moderate; however, organizations that run zipdetails on untrusted archives should prioritize remediation to prevent trivial processing failures.

How an attack unfolds

An attacker creates or modifies a ZIP archive so that it includes an Info-ZIP Unix Extra Field with tag 0x7875 and sets either the UID Size or GID Size field to 8. The attacker then delivers the archive to a system or workflow that runs the vulnerable zipdetails CLI tool against untrusted ZIP content, such as an automated file-inspection service, developer toolchain, email attachment analysis process, or malware triage script. During parsing, zipdetails attempts to decode the 8-byte UID or GID value, reaches the misspelled decode path, raises an undefined-subroutine exception, and exits abnormally. The attacker’s practical outcome is denial of service against that inspection step rather than compromise of the underlying IO::Compress libraries.

How to fix it

Upgrade IO::Compress to version 2.220 or later wherever the bundled zipdetails CLI tool is installed or used. If upgrading immediately is not possible, avoid running vulnerable zipdetails versions on untrusted ZIP archives, isolate ZIP metadata inspection in a sandboxed worker, and ensure automation handles zipdetails failures without halting critical pipelines. Because the affected component is the bundled CLI tool, applications that only use IO::Compress or IO::Uncompress library APIs are not directly affected by this defect, but packages should still be updated to remove the vulnerable utility from the environment.

How to confirm the fix worked

Confirm the installed IO::Compress version is 2.220 or later and verify the zipdetails script no longer contains a call to unpackValueQ without the underscore. On systems with Perl modules installed, check the module version using package-management tooling or a Perl one-liner such as querying IO::Compress::Zip::VERSION, and verify the zipdetails executable comes from the updated package. As a functional validation, run the updated zipdetails against a controlled ZIP sample containing an Info-ZIP Unix Extra Field with an 8-byte UID or GID and confirm it does not exit with “Undefined subroutine &main::unpackValueQ” or status 255.

Typical attack path

1. Identify a target workflow that runs the Perl zipdetails CLI tool on ZIP archives.
2. Craft a ZIP archive containing an Info-ZIP Unix Extra Field with tag 0x7875.
3. Set the UID Size or GID Size in that extra field to 8 bytes.
4. Submit or deliver the crafted archive to the target workflow.
5. The vulnerable zipdetails process parses the archive and calls the misspelled unpackValueQ helper.
6. zipdetails terminates with an undefined-subroutine error and exit status 255, disrupting the workflow that depended on it.

How to detect it

Review logs from file-ingestion services, CI jobs, malware-analysis sandboxes, email attachment scanners, archive metadata pipelines, and developer automation that invoke zipdetails. Look for abnormal process exits with status 255 and Perl runtime errors referencing “Undefined subroutine &main::unpackValueQ”. Correlate these crashes with recently processed ZIP files, especially files from external or untrusted sources. Preserve suspicious ZIP samples and inspect their central directory or local file headers for an Info-ZIP Unix Extra Field with tag 0x7875 and UID Size or GID Size equal to 8. There are no known named threat actors, KEV exploitation, ransomware usage, or mature public exploit campaigns associated with this issue as provided, so detection should focus on crash artifacts and malicious or malformed ZIP inputs rather than actor-specific infrastructure.

• Undefined subroutine &main::unpackValueQ
• unpackValueQ
• decodeLitteEndian
• zipdetails
• exit status 255
• Info-ZIP Unix Extra Field
• 0x7875
• UID Size: 8
• GID Size: 8

What your security team should do

• Inventory systems, containers, CI images, malware-analysis sandboxes, and developer workstations that include Perl IO::Compress versions 2.207 through before 2.220 or the bundled zipdetails CLI tool.
• Prioritize upgrades to IO::Compress 2.220 or later on systems that process untrusted ZIP archives automatically.
• Add monitoring for zipdetails crashes containing “Undefined subroutine &main::unpackValueQ” to identify attempted or accidental triggering of the flaw.
• Ensure file-processing pipelines treat zipdetails failures as non-fatal where possible and route failed samples for review instead of stopping the entire workflow.
• Sandbox archive-inspection tooling that handles external or untrusted files, even after patching, to reduce impact from future parser bugs.
• Because KEV and ransomware flags are negative and EPSS is low, treat this as a targeted hardening and reliability issue rather than an emergency internet-wide incident unless zipdetails is exposed in critical ingestion paths.