XS::Parse::Infix EUVD-2026-88344

Exploitation requires a consuming Perl application (using XS::Parse::Infix 0.40-0.49) that invokes a list-associative infix operator - such as zip from Syntax::Operator::Zip - on a list constructed from attacker-influenceable data, typically decoded external input like a JSON array. The attacker must be able to place a value where an array reference is expected: a bare IV/NV number reliably triggers a segfault (DoS), while a specially crafted string with byte 12 set to 0x0b (SVt_PVAV) bypasses the accidental croak and drives a controlled dereference. Limiting factors: this is a library flaw with no standalone attack surface - it is only reachable if the application feeds untrusted data into such an operator, so real-world exposure depends heavily on downstream usage; there is no authentication or user-interaction requirement inherent to the flaw itself.

This is a CWE-843 type-confusion / memory-safety flaw in the XS::Parse::Infix Perl module (versions 0.40-0.49), where a list-associative infix operator's generated wrapper validates array-reference arguments with SvRV() instead of SvROK(), so the reference guard never actually confirms the SV holds a reference. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) scores only availability impact (segfault/DoS), but the description goes further: an attacker-crafted string with byte 12 = 0x0b bypasses the accidental croak and is then treated as an AV head, with AvARRAY read from bytes 16-23 and its entries pushed onto the Perl stack as live SVs - a controlled-dereference primitive that plausibly enables information disclosure and possibly worse. The signals largely agree on real but bounded risk: EPSS is very low (0.18%, 7th percentile), there is NO CISA KEV listing (not actively exploited), and no wide-scale exploitation is expected, but a working proof-of-concept IS embedded in the advisory (the Syntax::Operator::Zip zip(@args) example), so the barrier to triggering at least a crash is trivial. The key caveat: exploitation is entirely conditional on a downstream application passing attacker-influenceable, decoded input (e.g. from JSON) into a list-associative infix operator - this is a library-level flaw whose real-world reachability depends on how consuming applications use it, so AV:N/PR:N describes the theoretical path rather than a guaranteed remote-unauthenticated hit against every install.

An application decodes untrusted input (for example a JSON array from an API request) and passes the resulting list to a list-associative infix operator such as zip from Syntax::Operator::Zip. An attacker supplies a bare number (or a crafted string with byte 12 = 0x0b) where an array reference is expected; the flawed SvRV()-based guard treats the value as an array reference and dereferences an attacker-influenced address, causing a segmentation fault or, with a crafted string, reading arbitrary memory as live SVs. A proof-of-concept exists in the advisory (my @args = ([1], 2); zip(@args);).