CVE-2026-14739 is a heap overflow vulnerability (CWE-787) in the HMBRAND DBI Perl module affecting versions prior to 1.650. The flaw arises during the preparsing of SQL statements with an excessive number of placeholders, where memory allocation is insufficient, leading to an out-of-bounds write. This vulnerability is a follow-up to CVE-2026-10879, where the prior fix failed to handle extremely large placeholder counts. The issue is mitigated in DBI 1.650 by enforcing a maximum of 99,999 placeholders, preventing the overflow condition.

Successful exploitation could result in arbitrary code execution, data corruption, or denial of service due to heap memory corruption. The CVSS 3.1 score of 9.8 reflects critical impact with network attack vector, no privileges required, no user interaction, and high confidentiality, integrity, and availability impacts.

Upgrade to DBI version 1.650 or later, which implements a hard limit on the number of placeholders to prevent the heap overflow. No other official remediation or temporary fixes are documented. Patch status is not explicitly confirmed in the vendor advisory, but the version 1.650 release includes the fix.