CVE-2026-88816

Published: Set 28, 2026 Last Modified: Set 28, 2026

ExploitDB:

Other exploit source:

Google Dorks:

Description

AI Translation Available

DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName.

fetchrow_hashref uses the string pointer of the FetchHashKeyName attribute as the key name without stringifying it first. When FetchHashKeyName has been set to an integer (IV) or floating-point (NV) value, that pointer is invalid, so reading the key name triggers a segmentation fault.

This can be triggered with the following code:

my $dbh = DBI->connect( 'dbi:ExampleP:', '', '',
{ RaiseError => 0, PrintError => 0 } );
$dbh->{FetchHashKeyName} = 42;

my $sth = $dbh->prepare('select mode, size, name from .');
$sth->execute;
$sth->fetchrow_hashref;