The vulnerability exists in the gcm_decrypt_verify, ccm_decrypt_verify, chacha20poly1305_decrypt_verify, and eax_decrypt_verify XS routines of CryptX for Perl before version 0.088_001. These routines copy an authentication tag from the caller into a fixed-size 144-byte stack buffer without checking if the tag length exceeds this buffer size, leading to a stack-based buffer overflow (CWE-121). This can be triggered by any caller passing an attacker-controlled tag longer than 144 bytes. Version 0.088 introduced a clamp to gcm_decrypt_verify, and version 0.088_001 extended this fix to the other three routines.

A stack-based buffer overflow can lead to memory corruption, which may cause application crashes or potentially allow arbitrary code execution depending on the context in which the vulnerable routines are used. However, no known exploits in the wild have been reported. The vulnerability affects all versions of CryptX before 0.088_001.

No official patch or vendor advisory is currently available. Users should upgrade to CryptX version 0.088_001 or later, where the vulnerability is fixed by adding length checks (clamping) on the authentication tag input. Until an upgrade is possible, avoid passing untrusted or attacker-controlled authentication tags to the affected decrypt_verify helper routines.