Skip to main content

List::SomeUtils::XS EUVDEUVD-2026-39444

| CVE-2026-12844 HIGH
Out-of-bounds Write (CWE-787)
2026-06-25 CPANSec GHSA-h2pv-qmv8-hvcv
Buffer Overflow Memory Corruption List
7.5
CVSS 3.1 · Vendor: CPANSec
Share

Severity by source

Vendor (CPANSec) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.9 MEDIUM

Reachable via network-fed data only in apps whose pairwise block size is attacker-influenced (AC:H), no auth needed at that layer (PR:N), and impact is heap-corruption DoS, so A:H with C:N/I:N.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (CPANSec).

CVSS VectorVendor: CPANSec

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Source Code Evidence Fetched
Jul 22, 2026 - 20:16 vuln.today
Analysis Generated
Jul 22, 2026 - 20:16 vuln.today
CVE Published
Jun 25, 2026 - 15:26 cve.org
HIGH 7.5
CVE Published
Jun 25, 2026 - 15:26 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

List::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in the pairwise function.

pairwise() collects the values returned by the block into a heap buffer sized to the longer input array, then grows the buffer before each copy with a single quadrupling (alloc <<= 2) instead of a loop. A block call that returns more than four times the current allocation in one invocation outgrows that one quadrupling, and the copy writes past the end of the buffer.

Any caller of pairwise() whose block returns, for a single pair, more than four times the longer input array's length writes past the buffer and corrupts the heap.

AnalysisAI

Heap buffer overflow in the Perl module List::SomeUtils::XS before 0.59 lets a program corrupt heap memory whenever its pairwise() block returns, for a single input pair, more than four times the longer input array's length. The C-level pairwise() implementation grows its result buffer with a single quadrupling (alloc <<= 2) rather than a loop, so an oversized single-call return outruns the allocation and the copy writes past the buffer end. No public exploit identified at time of analysis; EPSS is low (0.42%) and SSVC records no observed exploitation, but a vendor patch (0.59) is available and the trigger is trivially demonstrable.

Technical ContextAI

List::SomeUtils::XS is the XS (C) acceleration backend for the widely-used List::SomeUtils Perl utility collection; when installed it transparently replaces the pure-Perl implementations with faster compiled versions. The affected pairwise() function walks two input arrays in parallel, invokes a user-supplied block for each pair, and collects the block's return values into a heap buffer (buf) of SV* pointers, initially sized to the longer of the two arrays. This is a classic CWE-787 Out-of-bounds Write: before each copy the code enlarged the buffer with a single 'alloc <<= 2' quadrupling instead of looping until the allocation was large enough, so any single block invocation returning more than 4x the current allocation writes SV* pointers beyond the end of buf, corrupting adjacent heap metadata and allocations. The CPE cpe:2.3:a:drolsky:list::someutils::xs:*:*:* confirms all versions prior to the fix are in scope.

RemediationAI

Vendor-released patch: upgrade List::SomeUtils::XS to version 0.59 or later (fix by Paul Johnson, replacing the single 'alloc <<= 2' with a 'while (nitems > alloc) alloc <<= 2' loop before Renew), available via CPAN and documented at https://metacpan.org/release/DROLSKY/List-SomeUtils-XS-0.59/changes; the exact code fix is in commit 22549f78669b780d6aa338a2d2e49a3dedfffaa6 (https://github.com/houseabsolute/List-SomeUtils-XS/commit/22549f78669b780d6aa338a2d2e49a3dedfffaa6.patch). On SUSE and other distributions, apply the vendor-provided perl-List-SomeUtils-XS update once it ships 0.59. If you cannot upgrade immediately, the effective compensating control is to force the pure-Perl fallback by uninstalling or not loading the XS backend (List::SomeUtils then uses its slower pure-Perl pairwise, which is not affected) at the cost of performance, or to audit and bound your pairwise() blocks so a single pair cannot return an attacker-influenced, unbounded list - trade-off is code changes and reduced flexibility. See also the oss-security advisory at https://seclists.org/oss-sec/2026/q2/1031.

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected

Share

EUVD-2026-39444 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy