7.3

CVE-2026-48961: pmqs io::compress

CVSS: 7.3v3.1HighDeferred
AliasesUBUNTU-CVE-2026-48961DEBIAN-CVE-2026-48961openSUSE-SU-2026:10969-1
Published 27-05-2026Last modified 29-05-2026
Open JSON

Vulnerability summary

CVE-2026-48961 is a high (CVSS 7.3) vulnerability in pmqs io::compress. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 33.8% of scored vulnerabilities.

Overall risk
29/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.3/10
010
High · v3.1 (CVE.org)
EPSS score
0.41%
0%100%
Low · +0.14 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 1
MGASA-2026-0158OPENSUSE-SU-2026:21177-1

Timeline

  1. 27-05-2026
    PublishedVulnerability first disclosed.
  2. 29-05-2026
    Last modifiedVulnerability information updated.

Description

IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID. When decode_ux() in bin/zipdetails handles an Info-ZIP Unix Extra Field (tag 0x7875) with UID Size or GID Size set to 8, causing zipdetails to decode an 8-byte UID or GID value, it dispatches through decodeLitteEndian(), which calls a misnamed helper unpackValueQ. The actual function defined in the same file is unpackValue_Q (with underscore); the call raises 'Undefined subroutine &main::unpackValueQ' and the script exits with status 255. Library callers of IO::Compress and IO::Uncompress are not affected; the defect is in the bundled CLI tool.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.41%

Chance of exploitation in the next 30 days

Percentile

34%

Versus all other CVEs

30-day change

+0.14 pp

From 0.26% on 22-09-2026

22-09-202622-10-2026
EPSS score
0.41%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Debian2 products
  • libio-compress-perl< 2.213-1+deb13u1 | < 2.220-1
  • perl< 5.40.1-6+deb13u1 | < 5.40.1-8
Ubuntu2 products
  • libio-compress-perlAll versions (No fix recorded)
  • perlAll versions (No fix recorded)
Opensuse1 product
  • perl-IO-Compress&distro=openSUSE Tumbleweed< 2.220.0-2.1
Pmqs1 product
  • io::compress≥ 2.207, < 2.220

4 vendors · 6 products

References

8 links