PeaZip: Out-of-bounds write in PEA archive extraction allows code execution
Summary
PeaZip versions 11.2.0 and earlier contain an out-of-bounds write in the PEA archive extraction routine. An attacker who convinces a user to open or extract a crafted .pea archive can execute arbitrary code with the privileges of the logged-in user, or crash the application. No password or non-default configuration is required, and the vendor fix is included in PeaZip 11.3.0.
Affected
- PeaZip 11.2.0 and earlier (CNA range: all versions before 11.3.0)
- Platforms: Windows, macOS, Linux, BSD
- Default configuration is affected
Fixed in
- PeaZip 11.3.0 or later (fix in commit 90ddbae; 11.4.0 is the current line according to a secondary report)
- Backports to older maintained branches: Unknown.
Workaround
- No vendor workaround documented.
- Do not open .pea archives from unknown senders until PeaZip is updated; use another extractor for these files.
Exploitation
- Code execution was reportedly demonstrated by two independent researchers (CNA statement, not independently verified).
- No public exploit or PoC found.
- Not listed in CISA KEV; no evidence of exploitation in the wild found.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- EPSS: 0.00129.
Our recommendation
- Identify all endpoints with PeaZip installed, including those installed through package managers or distribution builds.
- Update to PeaZip 11.3.0 or later, after verifying the version on the vendor site.
- Uninstall PeaZip where it is not needed.
- Until updated, do not open .pea files from untrusted sources.
- Monitor for a public PoC or KEV listing and check NVD once analysis is complete.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record (Secur0 CNA) secur0.com
- Fix commit 90ddbae (GitHub) github.com
- VulDB CVE-2026-102514 vuldb.com
- OSV CVE-2026-102514 vulners.com
- Strix CVE summary www.strix.ai
- Nixpkgs issue 569359 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:57.
Original description (NVD)
Out-of-bounds Write (CWE-787) in the PEA archive extraction routine (pea.pas, unpea_procedure) of the first-party pea component in PeaZip 11.2.0 and earlier allows an attacker who convinces a victim to open or extract a crafted .pea archive to execute arbitrary code as the user running PeaZip. While decompressing a PCOMPRESS1 stream, the 32-bit compressed-block-size field of the first block (compsize) is read directly from the archive and used without validation as the length of a blockread into the fixed-size global buffers wbuf1/wbuf2 (1,114,112 bytes) and as the bound of the subsequent copy loop. The existing check "compsize > WBUFSIZE" is applied only to the size of each following block, so the first block escapes it; the same unvalidated value is also used to index wbuf1[compsize], an out-of-bounds read at an attacker-chosen offset. The copy loop additionally copies the requested length instead of the number of bytes actually read, and terminates on equality rather than on an upper bound. Because the project is built without range checking and no archive password, integrity tag or non-default configuration is required, the overflow overwrites adjacent global data; code execution was demonstrated by two independent researchers against the official Linux x86-64 and Windows x64 builds, and the denial-of-service and memory-corruption primitive is cross-platform (Windows, macOS, Linux, BSD).
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.