ExtUtils-Typemaps-Default EUVD-2026-96314

Requires a downstream XS/C++ module built against ExtUtils::Typemaps::STL::String before 1.06 that actually uses the T_STD_STRING INPUT typemap, compiled by a C++ toolchain whose generated code evaluates SvCUR($arg) before SvPV_nolen($arg) (an unspecified, compiler-dependent ordering), AND a code path that passes a non-string Perl SV (integer, number, or reference) into the std::string conversion. Limiting factors: builds using compilers that evaluate left-to-right are unaffected; the bug cannot trigger unless the typemap is used and non-string input reaches it; impact beyond crash (information disclosure) is not guaranteed. This is not a flaw in a running service by default but a defect compiled into derivative XS modules.

Signals conflict sharply and should temper the headline 9.1. The input CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/A:H) implies a trivially remotely exploitable critical flaw, but the description describes a compiler-dependent C++ argument-evaluation-order bug in a Perl XS typemap that manifests only when a non-string SV is passed, producing an invalid SvCUR length. This is far more constrained than AC:L suggests: exploitation requires a downstream application to actually use the ExtUtils::Typemaps::STL::String T_STD_STRING typemap AND be compiled by a toolchain that evaluates SvCUR($arg) before SvPV_nolen($arg) AND route attacker-controlled non-string data into that conversion - none of which is guaranteed. CWE-125 (out-of-bounds read) and the primary described outcome ('abort or segfault') point to availability as the dominant, reliable impact, while the C:H rating depends on the OOB std::string copy leaking adjacent heap memory, which is plausible but conditional and not demonstrated. Corroborating real-risk signals are weak: EPSS is 0.19% (8th percentile), there is no CISA KEV listing, and no public exploit is identified. Net assessment: this is a legitimate memory-safety defect worth patching in affected build pipelines, but it is a high-CVSS/low-real-world-risk item for most organizations rather than an urgent widespread threat - the AC:L and C:H metrics appear optimistic given the compiler- and configuration-dependent trigger.

An application exposing a Perl/XS interface built with the vulnerable typemap (pre-1.06) receives an attacker-supplied non-string value - an integer, number, or reference - where a std::string argument is expected. On a C++ compiler whose codegen evaluates SvCUR($arg) before SvPV_nolen($arg), the std::string is constructed with a stale/invalid length and copies out-of-bounds heap memory, causing a segfault/denial of service or potentially leaking adjacent memory. No public exploit code exists at time of analysis.