Perl DBI CVE-2026-88816

Requires a Perl application built on DBI that assigns a non-string (integer/IV or float/NV) scalar to the FetchHashKeyName statement/handle attribute and then invokes fetchrow_hashref. It does not affect default usage where FetchHashKeyName is left as its string default ('NAME'). Exploitation is limited by the fact that this attribute is normally set by the application itself, not by remote input, so remote unauthenticated triggering (as the CVSS vector implies) depends on the application unsafely propagating attacker-controlled data into that attribute. Affected: DBI before 1.654.

This is a type-confusion bug (CWE-843) in the Perl DBI module's fetchrow_hashref implementation (DBI.xs), where SvPVX(kn) was used to read the FetchHashKeyName attribute value without forcing stringification. When that attribute holds an integer (IV) or float (NV) scalar rather than a string, the code dereferences the SV's string-buffer slot on a value that has none, producing an invalid/garbage pointer. The signals point to a low-to-moderate real-world priority rather than an urgent one: EPSS is very low (0.21%, 10th percentile), there is no CISA KEV listing (no confirmed active exploitation) and no public exploit identified. The vendor CVSS vector (AV:N/AC:L/PR:N/UI:N/A:H, 7.5) rates it as a remote unauthenticated availability (crash/DoS) issue, but this conflicts with the actual trigger: the flaw fires only when the *application itself* assigns a non-string value to the FetchHashKeyName attribute, which is not normally attacker-controllable over the network - verify the network/unauthenticated framing with the vendor. The Tags claim 'Information Disclosure' and 'Memory Corruption' while the CVSS marks C:N/I:N; reading the PV slot of an IV/NV could in principle expose adjacent memory as a hash key name, but the primary demonstrated impact in the added test is a controlled crash/exception, so availability is the dependable impact.

A Perl application using DBI sets $dbh->{FetchHashKeyName} (directly or from unvalidated input) to a numeric scalar such as 42, then calls $sth->fetchrow_hashref. Pre-patch, DBI reads the string-buffer pointer of the integer SV, dereferencing a bogus pointer and crashing the process (or reading unintended memory). No public exploit exists and no active exploitation is reported; realistic abuse requires the application to route attacker-influenced data into this attribute.