Perl DBI CVE-2026-88815

Exploitation requires that the affected application actually invoke DBI::sql_type_cast on a Perl scalar holding an internal integer (IV) or numeric/double (NV) value - the specific code path the fix addresses - with a value the attacker can influence. Limiting factors: this is an internal library routine, so reachability depends on the DBD driver and application logic rather than any default remote endpoint; there is no evidence of unauthenticated network exposure, and impact appears confined to incorrect casting, a crash, or limited memory over-read rather than code execution. No CVSS vector was provided to confirm attack vector, privilege, or user-interaction requirements.

This entry is extremely data-sparse: no CVSS score or vector, no CWE, no EPSS, no KEV listing, and no POC - the only substantive artifact is a commit-message-style title ('Fix DBI::sql_type_cast on IV/NV') and an Ubuntu vendor report. Exploitation status is therefore 'no public exploit identified at time of analysis,' and authentication requirements cannot be confirmed because no CVSS vector was provided. The affected code, DBI::sql_type_cast, is an XS/C-level routine in the Perl DBI database-interface module that casts a Perl scalar to a SQL type; the 'IV/NV' qualifier points to mishandling of scalars that already carry an integer (IV) or double (NV) internal value rather than a string, which is characteristic of a type-confusion or out-of-bounds read/miscast rather than a directly remotely-weaponizable flaw. Real-world risk is best treated as LOW-to-MODERATE and application-dependent: DBI is very widely deployed in the Perl ecosystem, but reachability of this specific cast path depends entirely on whether an application feeds attacker-influenced values through sql_type_cast, so this is more of a correctness/hardening fix than a broadly exploitable network vulnerability. Because the CVSS vector is missing, any attack-vector/complexity/privilege claim below is INFERRED from the code semantics, not confirmed - this should be verified against the upstream DBI changelog and the Ubuntu security advisory.

An application passes attacker-influenceable data (e.g., query-result values or user input) through DBI's sql_type_cast with an integer or numeric-valued scalar, triggering the IV/NV mishandling to produce an incorrect cast or an out-of-bounds read. In the worst realistic case this yields a crash (DoS) or leakage of adjacent memory contents; no public exploit code is identified at time of analysis, and reachability is entirely dependent on how the host application uses the function.