CVE-2026-73193: CWE-190 Integer Overflow or Wraparound
DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse. preparse reserves its output buffer with `newSV(strlen(statement) * 7 + 16)`, budgeting seven output bytes per input byte for the longest ':p99999' expansion. The product is computed in STRLEN, which is 32 bits wide on a 32-bit perl build, so a statement of 613,566,757 bytes multiplies to 4,294,967,299, wraps modulo 2^32 to 3, and reserves 19 bytes. The parser then copies the statement out through a raw pointer with no capacity check, writing the whole 585 MB input past the end of the allocation. The 99,999 placeholder limit does not bound this path, which is reached by ordinary non-placeholder content. Any caller that passes an untrusted statement of that length to preparse on a 32-bit perl gets a heap out-of-bounds write of attacker controlled bytes. Builds with a 64-bit STRLEN are not affected, since the wrap there needs a statement of about 2.3 exabytes.
AI Analysis
Technical Summary
The vulnerability arises from the preparse function in DBI versions prior to 1.652, which reserves an output buffer based on the length of the input statement multiplied by seven plus sixteen. On 32-bit Perl builds, this multiplication can overflow the 32-bit STRLEN type, causing the buffer size to wrap around to a small value. Consequently, the parser writes beyond the allocated buffer when copying the input statement, resulting in a heap out-of-bounds write. This issue does not affect 64-bit Perl builds due to the much larger STRLEN size. The vulnerability can be triggered by passing an untrusted statement approximately 613 million bytes in length, leading to potential memory corruption.
Potential Impact
Successful exploitation can cause a heap out-of-bounds write, which may lead to arbitrary code execution, denial of service, or other memory corruption impacts. The CVSS score of 9.8 reflects the high severity, with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
No official patch or remediation level is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted input statements of extremely large size on 32-bit Perl builds using DBI versions before 1.652.
CVE-2026-73193: CWE-190 Integer Overflow or Wraparound
Description
DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse. preparse reserves its output buffer with `newSV(strlen(statement) * 7 + 16)`, budgeting seven output bytes per input byte for the longest ':p99999' expansion. The product is computed in STRLEN, which is 32 bits wide on a 32-bit perl build, so a statement of 613,566,757 bytes multiplies to 4,294,967,299, wraps modulo 2^32 to 3, and reserves 19 bytes. The parser then copies the statement out through a raw pointer with no capacity check, writing the whole 585 MB input past the end of the allocation. The 99,999 placeholder limit does not bound this path, which is reached by ordinary non-placeholder content. Any caller that passes an untrusted statement of that length to preparse on a 32-bit perl gets a heap out-of-bounds write of attacker controlled bytes. Builds with a 64-bit STRLEN are not affected, since the wrap there needs a statement of about 2.3 exabytes.
CVSS v3.1
Score 9.8critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises from the preparse function in DBI versions prior to 1.652, which reserves an output buffer based on the length of the input statement multiplied by seven plus sixteen. On 32-bit Perl builds, this multiplication can overflow the 32-bit STRLEN type, causing the buffer size to wrap around to a small value. Consequently, the parser writes beyond the allocated buffer when copying the input statement, resulting in a heap out-of-bounds write. This issue does not affect 64-bit Perl builds due to the much larger STRLEN size. The vulnerability can be triggered by passing an untrusted statement approximately 613 million bytes in length, leading to potential memory corruption.
Potential Impact
Successful exploitation can cause a heap out-of-bounds write, which may lead to arbitrary code execution, denial of service, or other memory corruption impacts. The CVSS score of 9.8 reflects the high severity, with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
No official patch or remediation level is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted input statements of extremely large size on 32-bit Perl builds using DBI versions before 1.652.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CPANSec
- Date Reserved
- 2026-08-11T11:58:19.137Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a805affbf8831d5390c8130
Added to database: 08/15/2026, 12:26:39 UTC
Last enriched: 08/22/2026, 13:12:36 UTC
Last updated: 09/05/2026, 10:52:11 UTC
Views: 58
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.