CVE-2026-64193 is a critical code injection vulnerability in NLNETLABS Net::DNS versions up to 1.55 for Perl. The vulnerability occurs in the Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose function, which parses the EXTRA-TEXT field of the EDNS EXTENDED-ERROR option (RFC 8914). This function tokenizes raw bytes and passes them to Perl's eval function. Although some escaping is done for the $ and @ characters, backticks are not escaped, enabling an attacker to inject and execute arbitrary commands remotely if the vulnerable code calls $pkt->edns->option('EXTENDED-ERROR') in array context with a crafted payload. The CVSS v3.1 score is 9.8, reflecting high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary code on the affected system without authentication, leading to complete compromise of confidentiality, integrity, and availability of the system running Net::DNS. This can result in unauthorized command execution and potential full system takeover.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, avoid processing untrusted EDNS EXTENDED-ERROR options or calling $pkt->edns->option('EXTENDED-ERROR') in array context. Monitor vendor communications for updates and apply official fixes once released.