Perl DBI EUVD-2026-59745

Exploitation requires that the target application call DBI's preparse() on attacker-influenced statement text using the ':N'/':pN' named-to-numbered return style (DBIpp_ph_cn), and that the poisoned numeric placeholder (e.g. ':2147483648', a value that wraps negative via atoi on glibc) be followed by one or more '?' marks - the overflow size grows with the number of trailing '?'. Limiting factors: applications using the '?' or '%s' return styles are NOT affected because those styles validate the parsed number against the expected sequence and error out; the wrap-to-negative behavior depends on atoi/glibc semantics; and the flow only reaches unsafe expansion because the 1.650 placeholder cap checks only against 99,999. This is therefore not a default-configuration remote flaw for every DBI user - it is gated on a specific, opt-in preparse usage pattern with untrusted input.

The signals are mixed and should temper the 9.1 headline. CVSS is AV:N/AC:L/PR:N/UI:N, implying trivial remote unauthenticated exploitation, but that only holds if an application actually feeds untrusted input through preparse() using the ':pN'/':N' return style - a real but far-from-universal usage pattern, since the '?' and '%s' return styles validate the sequence and are explicitly unaffected. EPSS is low (0.20%, 10th percentile), the CVE is not in CISA KEV, and no public exploit is identified, so there is no evidence of active or imminent mass exploitation. Turning a heap out-of-bounds write into reliable code execution requires heap grooming and is allocator-dependent, which raises real-world attack complexity above what AC:L suggests. The provided NVD-style vector rates C:H/I:N/A:H, which is atypical for a pure write primitive (a memory-write flaw usually implies an integrity impact, not primarily confidentiality) - verify the impact metrics with the vendor advisory. Net assessment: prioritize patching wherever DBI preparse handles externally influenced statements, since the fix is a clean library upgrade and the downside of a heap write is severe, but for deployments that never route untrusted SQL through the named-placeholder preparse path the practical urgency is lower than the CVSS number alone implies.

An application uses DBI's preparse() with the named-to-numbered (':pN') return style to normalize SQL that incorporates externally supplied text; an attacker submits a statement containing ':2147483648' followed by several '?' placeholders. The poisoned negative binder counter bypasses the 99,999 limit, and each following '?' expands to the oversized ':p-2147483648' string, writing past the heap buffer to corrupt adjacent allocations - a foothold an attacker could attempt to develop toward code execution. No public proof-of-concept is identified at this time.