EUVD-2026-59745Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Heap write reachable via untrusted preparse input (AV:N, PR:N), but requires the specific ':pN' return style and allocator-dependent grooming for control, so AC:H; a write primitive yields I:H/A:H with no direct confidentiality impact.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse.
preparse reserves seven output bytes per input byte, the width of the longest ':p99999' expansion. The ':N' branch parses the number with atoi(src) and assigns it to the binder counter with no range check, so a statement containing ':2147483648' leaves the counter negative (-2147483648 with glibc, where atoi wraps). Each following '?' then expands through sprintf(start, ":p%d", idx++) to ':p-2147483648', 14 bytes with the terminating NUL where the buffer budgets 7. The placeholder limit added in 1.650 tests the counter against 99,999, which a negative counter passes.
Any caller that preparses an untrusted statement into ':pN' style placeholders gets a heap out-of-bounds write that grows with the number of '?' marks following the poisoned placeholder. The '?' and '%s' return styles compare the parsed number against the expected sequence and error out, and are unaffected.
AnalysisAI
Heap out-of-bounds write in the Perl DBI module before version 1.652 lets an attacker who reaches the preparse() routine with attacker-controlled SQL corrupt heap memory when the ':pN' / ':N' (named-to-numbered) placeholder return style is used. A numeric placeholder such as ':2147483648' is parsed with atoi() and stored in the binder counter with no range check; on glibc it wraps negative, and each following '?' then expands to a 14-byte ':p-2147483648' string into a buffer that budgeted only 7 bytes per input byte. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application call DBI's preparse() on attacker-influenced statement text using the ':N'/':pN' named-to-numbered return style (DBIpp_ph_cn), and that the poisoned numeric placeholder (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are mixed and should temper the 9.1 headline. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An application uses DBI's preparse() with the named-to-numbered (':pN') return style to normalize SQL that incorporates externally supplied text; an attacker submits a statement containing ':2147483648' followed by several '?' placeholders. The poisoned negative binder counter bypasses the 99,999 limit, and each following '?' expands to the oversized ':p-2147483648' string, writing past the heap buffer to corrupt adjacent allocations - a foothold an attacker could attempt to develop toward code execution. … |
| Remediation | Vendor-released patch: upgrade DBI to 1.652 or later (fix commit 29b72ae7d2a8114a734a55840bf1c45b89207809), which forces the placeholder limit onto the ':#' and ':p#' branches by rejecting any parsed value that is >99999 or <=0 before expansion. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running Perl DBI to identify those before version 1.652, prioritizing production database layers. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today