TI-2025-14272 Aliases CVE-2025-15649 GHSA-hcq9-8v5x-mqjp

IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when…

LOW 24CWE-248Published 2026-05-27 · Updated 2026-05-29

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 4 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-248.

Summary

IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date. _dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die. The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00127 2nd percentileScored 2026-11-07

Fix Partial IO::Uncompress::Unzip (PMQS): 2.215Red Hat: 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
PMQS	IO::Uncompress::Unzip	before 2.215	2.215	Patch available	CNA

IO::Uncompress::Unzip VendorPMQS Affected before 2.215 Fixed in 2.215 Patch available CNA

Remediation

Fix · CNA IO::Uncompress::Unzip (PMQS) Fixed in 2.215

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 7	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2025-15649
2026-10-03 Alias added: GHSA-hcq9-8v5x-mqjp

References

Patch 1

https://github.com/pmqs/IO-Compress/commit/fd28c1d2374eee9811f6d0c5bddc0957abdf1da8.patch

Other 2

TI-2026-02917 Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of… CVSS 3.1CRITICAL 9.8
TI-2026-36217 IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte… CVSS 3.1HIGH 7.5
TI-2026-36219 IO::Compress versions before 2.220 for Perl can execute arbitrary code in… CVSS 3.1HIGH 7.3
TI-2026-36218 Improper handling of exceptional conditions in PMQS IO::Compress CVSS 3.1HIGH 7.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences