The bug is located in the IO::Compress zipdetails command line tool, not in the library functions used by application code. When the tool processes an Info‑ZIP Unix Extra Field containing an 8‑byte UID or GID, an undefined subroutine error occurs, causing the program to terminate with exit status 255. The crash does not allow arbitrary code execution, but it does prevent the tool from completing, which can interrupt scripts or user operations relying on zipdetails.

This issue affects the PMQS IO::Compress Perl module versions 2.207 up to and including 2.219. It specifically impacts the bundled zipdetails command line utility; users of IO::Uncompress or other callers of IO::Compress are not impacted.

No CVSS score is published for this vulnerability, and EPSS data is unavailable. It has not been listed in CISA's KEV catalog. Because the flaw exists only in the command line tool, an attacker would need to execute zipdetails within the context of a user or application that invokes it. The exposure is local, with a limited scope of potential denial of service. The low availability of exploitation data suggests a low to moderate likelihood of real‑world attacks, but the impact is significant enough that updating the module should be treated as a high‑priority mitigation.