CVE-2026-57073 is an out-of-bounds read vulnerability (CWE-125) in the HTML::Bare Perl module versions up to and including 0.04. The parserc_parse function performs unbounded character lookahead when parsing multicharacter strings such as "<![CDATA" or element terminators like ">" without validating that the offsets accessed are within the buffer limits. This can lead to reading memory beyond the intended buffer when processing truncated input strings, such as "<a/". The vulnerability is critical with a CVSS 3.1 base score of 9.1, indicating network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality and availability. No official fix or patch is documented, though newer versions exist in the git repository that may address this issue.

Successful exploitation of this vulnerability can cause an out-of-bounds read, potentially leading to information disclosure and denial of service conditions due to application crashes. The CVSS score of 9.1 reflects high confidentiality and availability impact. There is no indication of integrity impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory or git repository for current remediation guidance. Users should avoid processing untrusted input with affected versions (<=0.04) of HTML::Bare. Consider upgrading to newer versions available in the git repository if they address this vulnerability. Monitor official sources for an official fix or patch.