CVE-2026-57074 is an out-of-bounds read vulnerability (CWE-125) in XML::Bare versions up to 0.53 for Perl. The parserc_parse function performs lookahead checks for specific XML constructs such as "<![CDATA" or ">" without ensuring that the offsets accessed are within the buffer limits. This can lead to reading memory beyond the intended buffer when processing truncated XML input like "<a/". The vulnerability is rated critical with a CVSS 3.1 score of 9.1, indicating high impact on confidentiality and availability.

Successful exploitation can cause an out-of-bounds read, potentially leading to application crashes or exposure of sensitive memory contents. The CVSS vector indicates no required privileges or user interaction, and the attack can be performed remotely over the network, impacting confidentiality and availability with high severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor the vendor's communications for updates and avoid processing untrusted or truncated XML inputs with affected versions until a fix is available.