Net::IDN::Punycode CVE-2026-74766

Requires a Perl application to call Net::IDN::Punycode's decode_punycode on attacker-supplied input while using the affected XS backend at versions 2.301 through 2.589 (fixed in 2.590). The triggering label must contain enough code points above U+FFFF (four UTF-8 bytes each) to outgrow the output buffer, which is pre-sized at twice the label length, forcing the reallocation. LIMITS: the pure-Perl (PP) backend is explicitly NOT affected, so deployments forcing the PP implementation are safe; exploitability and network reachability depend entirely on whether and how the consuming application decodes untrusted punycode (e.g., IDN domains/emails), and no authentication or user interaction is inherent to the library call itself.

This is a genuine heap use-after-free (CWE-416) in the XS backend of a real, maintained Perl IDN library, confirmed by source diff and a vendor patch. Key signal conflict: the input CVSS vector is AV:L (local) yet PR:N/UI:N, while the flaw is triggered by 'an attacker-supplied punycode label' - for the module's most common use (decoding IDN domains, URLs, or email addresses arriving over the network), the realistic attack vector is network-reachable, so AV:L likely understates reachability; I assess AV:N and flag this for verification, since a pure library's base vector depends on the consuming application. The C:H/I:H/A:H impact is defensible because the bug is a read-and-write through a freed pointer (a heap corruption + potential info-leak primitive), but no weaponized exploit or demonstrated RCE exists - the patch ships only a round-trip regression test, not an exploit. No EPSS score, no CISA KEV listing, and no standalone POC were provided. Net: a technically serious memory-corruption bug with a confirmed fix, but current evidence points to crash/info-disclosure potential rather than proven, widespread exploitation - moderate real-world priority, prioritized where Perl services decode untrusted punycode via the XS backend.

An attacker submits a punycode label containing many code points above U+FFFF (each four UTF-8 bytes) - for example embedded in an IDN domain, URL, or email address - to a Perl application that decodes it via the affected XS backend. The label outgrows the initial buffer (sized at twice the label length), forcing a reallocation that frees the buffer while the stale insertion pointer is still used, so the subsequent move and code-point write hit freed heap memory, enabling memory disclosure or heap corruption. No public weaponized exploit exists; the vendor patch adds only a decode round-trip regression test.