Compress::Raw::Zlib is a core module bundled with the Perl interpreter. The vendored copy of zlib is vulnerable to CVE-2026-3381 and related CVE-2026-27171. When the module processes compressed data, the underlying vulnerable zlib can be exploited, potentially leading to a high impact. Based on the high CVSS score, it is inferred that an attacker could achieve code execution or other severe compromise, but the exact attack outcome is not explicitly stated in the vendor’s description.

Perl releases from 5.9.4 to 5.40.3, from 5.41.0 to 5.42.1, and from 5.43.0 to 5.43.8 ship the vulnerable Compress::Raw::Zlib. The issue was resolved in Perl 5.40.4, 5.42.2, and 5.43.9, which bundle Compress::Raw::Zlib 2.222. Some Linux distributions rebuild Perl to link against the system zlib; if the system zlib is 1.3.2 or newer, or includes backported patches, the vulnerability may not apply.

The CVSS score of 9.8 indicates a high severity, and the EPSS score of < 1% shows low current exploitation data, but the high potential impact requires immediate attention. Based on the description of the bundled module’s reliance on a vendored zlib implementation, it is inferred that the likely attack vector involves supplying specially crafted compressed data to a Perl process. This could occur through local file input or remote network interfaces that parse or decompress data within a Perl application. The vulnerability is not listed in the CISA KEV catalog, underscoring the need for proactive patching.