Perl Socket CVE-2026-12087

Socket is the core Perl module (distribution PEVANS/Socket) that provides networking constants and the pack/unpack helpers for socket address structures such as sockaddr_in, ip_mreq and ip_mreq_source. The bug lives in the XS (C) layer, Socket.xs, in pack_ip_mreq_source(), which builds a struct ip_mreq_source containing multiaddr, source and interface addresses. The function validates the byte length of the source argument before that argument is actually fetched, so it inadvertently re-tests the length of the preceding multiaddr argument. Because both IPv4 addresses occupy a fixed 4-byte field, a well-formed 4-byte multiaddr causes the check to pass for a source of any length, after which a fixed-size 4-byte copy into imr_sourceaddr reads past the end of an under-length source buffer. This is a classic CWE-125 out-of-bounds read caused by an off-by-argument bounds check preceding a fixed-width memory copy.