The vulnerability CVE-2026-41565 is a stack-based buffer overflow (CWE-121) in the CryptX Perl module before version 0.088_001. Four AEAD decrypt_verify helper functions copy the authentication tag into a fixed-size 144-byte stack buffer without checking the tag length. An attacker can supply a tag longer than 144 bytes, causing a stack overflow. The overflow can be triggered by any caller forwarding an attacker-controlled tag exceeding the buffer size. The vulnerability was partially mitigated in version 0.088 for gcm_decrypt_verify and fully mitigated in 0.088_001 for the other three functions by adding length clamps. No official patch or advisory details are currently available to confirm remediation status.

Successful exploitation of this vulnerability can cause a stack-based buffer overflow, which may lead to denial of service (application crash) or potentially arbitrary code execution depending on the context of use. The CVSS score is 7.5 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability. There is no indication of confidentiality or integrity impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to CryptX version 0.088_001 or later, where length clamps were added to prevent the overflow. Until an official patch or advisory is available, avoid passing untrusted or attacker-controlled authentication tags longer than 144 bytes to the affected decrypt_verify functions.