CVE-2026-107373
Description
AI Translation Available
ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument.
The typemap uses
$var = std::string( SvPV_nolen($arg), SvCUR($arg) )
However, evaluation order for C++ arguments is not specified, and some compilers may produce code that evalutes SvCUR($arg) first.
When $arg is not a string (for example, an interger, number or a reference) then SvCUR will return an invalid value, and the program may abort or segfault.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0019
Percentile
0,1th
Updated
Single Data Point
Only one EPSS measurement is available for this CVE. Trend analysis requires multiple data points over time.
125
Out-of-bounds Read
DraftCommon Consequences
Security Scopes Affected:
Confidentiality
Availability
Other
Potential Impacts:
Read Memory
Bypass Protection Mechanism
Dos: Crash, Exit, Or Restart
Varies By Context
Applicable Platforms
Languages:
Memory-Unsafe, C, C++
Technologies:
ICS/OT
https://github.com/tsee/extutils-typemap-default/commit/a6b9c298b34ddadc5829614…
https://metacpan.org/release/SMUELLER/ExtUtils-Typemaps-Default-1.06/changes
https://rt.cpan.org/Public/Bug/Display.html?id=94110
https://www.cve.org/CVERecord?id=CVE-2026-80490