CVE-2025-15649 PUBLISHED

IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date

Assigner: CPANSec
Reserved: 26.05.2026 Published: 27.05.2026 Updated: 27.05.2026

IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date.

_dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die.

The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.

Product Status

Vendor PMQS
Product IO::Uncompress::Unzip
Versions Default: unaffected
  • affected from 0 to 2.215 (excl.)

Solutions

Upgrade to IO-Compress 2.215 or later.

References

Problem Types

  • CWE-248 Uncaught Exception CWE