XML::Bare CVE-2026-57074

Exploitation requires only that the target application pass attacker-controlled XML input to XML::Bare's parser (parserc_parse) in a version at or below 0.53 - the concrete trigger is a truncated or improperly terminated construct, such as an element tail like '<a/' lacking the closing '>' or a partial '<![CDATA[' token, that ends near the buffer boundary so the multi-byte lookahead reads past it. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction against a network-reachable parser. The principal LIMITING factor is deployment: the flaw is only reachable to the extent the application actually parses untrusted or remote XML with this specific module - a program that only parses trusted local XML reduces this to a local (AV:L) issue, and impact is bounded (likely a crash or small adjacent-memory read rather than full data exfiltration), consistent with SSVC's 'partial' technical impact.

Signals conflict on severity. The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:H, score 9.1) treats this as a high-confidentiality, high-availability network flaw, but SSVC rates Technical Impact only 'partial' and Exploitation 'none', and EPSS is low at 0.19% (8th percentile). The realistic impact of a bounded lookahead OOB read is a process crash (denial of service) or leakage of a few bytes of adjacent memory - the 'C:H' rating in particular looks generous for a small over-read, which is why the independent assessment below downgrades confidentiality and availability to Low. What raises priority is exposure and automatability: any Perl service that parses attacker-supplied XML with XML::Bare is reachable network-side with no authentication or user interaction, and SSVC marks it automatable=yes, so opportunistic fuzzing-style triggering is plausible. Net: not an emergency (no KEV, no known exploit, low EPSS) but a genuine reliability/DoS concern worth patching promptly where untrusted XML is processed. The 'network' attack vector is context-dependent - it applies only when the XML originates from a remote source; a tool parsing only local files would effectively be local (AV:L).

An attacker sends a crafted, truncated XML payload (for example a document ending in '<a/' with no closing '>') to a Perl web service or job that parses request bodies with XML::Bare. The unbounded lookahead in parserc_parse dereferences bytes past the buffer, crashing the worker (denial of service) or returning a few bytes of adjacent heap memory. No authentication or user interaction is required; no public exploit is identified, but the trigger is trivial to construct and automatable per SSVC.