Heap buffer overflow in List::SomeUtils::XS pairwise function (CVE-2026-12844)

List::SomeUtils::XS before version 0.59 for Perl contains a heap-based buffer overflow in the pairwise() function. The buffer growth logic uses a single quadrupling operation rather than a loop, allowing a block that returns more than four times the current allocation in a single invocation to write past the end of the heap buffer. This results in heap corruption for any caller of pairwise() whose block returns, for a single pair, more than four times the longer input array's length. Affected versions: - before 0.59 We recommend updating to: 0.59. CVSS 7.5 · our assessment: this_week Reference: https://seclists.org/oss-sec/2026/q2/1031 Details: https://vuln.today/cve/CVE-2026-12844