PeaZip’s PEA extraction routine performs an out‑of‑bounds write as it decompresses the first PCOMPRESS1 block. The 32‑bit compressed‑block‑size field is read directly and used to fill a fixed‑size server buffer without validation, allowing an attacker to overflow the buffer and overwrite adjacent data. The flaw also permits an out‑of‑bounds read and a bounds‑check failure, and the copy loop copies an unchecked length rather than the actual number of bytes read. Researchers have demonstrated successful code execution on official Linux x86‑64 and Windows x64 builds, showing that the vulnerability can be exploited on all major operating systems without additional configuration. Affected systems are all installations of PeaZip 11.2.0 and earlier, spanning Windows, macOS, Linux, and BSD. Any user who opens or extracts a malicious .pea archive with these versions can trigger the overflow, which results in arbitrary code execution running under the current user’s privileges. The CVSS score of 8.4 indicates a high‑severity flaw, but the EPSS score is <1%, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local, relying on social engineering whereby a user is convinced to open a malicious archive. An attacker who succeeds can execute code with the same privileges as the running user and potentially compromise the entire system. The exploitation does not require any special configuration or elevated privileges.

All versions of PeaZip 11.2.0 and earlier across Windows, macOS, Linux, and BSD are affected. The flaw exists in the original PeaZip binary and applies to all builds whether compiled for x86‑64, x86, or other architectures. The vulnerability is triggered whenever a malicious .pea file is opened or extracted with the affected PeaZip versions.

The high CVSS score indicates that this issue could have severe consequences if exploited. However, the very low EPSS suggests that exploit attempts are unlikely to appear in the near future. The exploit does not depend on special credentials and can be performed via a simple double‑click or right‑click “Extract” action on a crafted archive, making it a realistic threat for users who inadvertently accept malicious files. Because the overflow overwrites global data structures, the impact is a full process compromise that can be leveraged for more persistent malicious activity.