Advisories ยป MGASA-2026-0593

Updated peazip package fixes security vulnerabilities

Publication date: 12 Nov 2026
Modification date: 12 Nov 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-102514 , CVE-2026-105050

Description

CVE-2026-102514 - Out-of-bounds Write (CWE-787) in the PEA archive
extraction routine (pea.pas, unpea_procedure) of the first-party pea
component in PeaZip 11.2.0 and earlier allows an attacker who convinces
a victim to open or extract a crafted .pea archive to execute arbitrary
code as the user running PeaZip. While decompressing a PCOMPRESS1
stream, the 32-bit compressed-block-size field of the first block
(compsize) is read directly from the archive and used without validation
as the length of a blockread into the fixed-size global buffers
wbuf1/wbuf2 (1,114,112 bytes) and as the bound of the subsequent copy
loop. The existing check "compsize > WBUFSIZE" is applied only to the
size of each following block, so the first block escapes it; the same
unvalidated value is also used to index wbuf1[compsize], an
out-of-bounds read at an attacker-chosen offset. The copy loop
additionally copies the requested length instead of the number of bytes
actually read, and terminates on equality rather than on an upper bound.
Because the project is built without range checking and no archive
password, integrity tag or non-default configuration is required, the
overflow overwrites adjacent global data; code execution was
demonstrated by two independent researchers against the official Linux
x86-64 and Windows x64 builds, and the denial-of-service and
memory-corruption primitive is cross-platform (Windows, macOS, Linux,
BSD).
CVE CVE-2026-105050 - PeaZip before 11.3.0, in a non-default
configuration, is vulnerable to OS command injection via a filename in
an archive because "quotation character already used in the string" is
mishandled.

References

SRPMS

10/core