DBI versions prior to 1.652 for Perl contain a heap out-of-bounds write vulnerability on 32-bit Perl due to an integer wraparound in the output buffer size computed by the preparse function. The buffer size is calculated as newSV(strlen(statement) * 7 + 16), where strlen is a 32-bit value on 32-bit Perl. For very large input statements (around 613 million bytes), the multiplication overflows and wraps modulo 2^32, causing the buffer to be allocated too small (19 bytes). The parser then copies the entire input statement through a raw pointer without capacity checks, resulting in a heap overflow of attacker-controlled data. The vulnerability does not affect 64-bit Perl builds because the length calculation uses a 64-bit integer, requiring an input size of about 2.3 exabytes to overflow.

An attacker supplying a crafted, very large input statement to the preparse function on 32-bit Perl DBI versions before 1.652 can trigger a heap out-of-bounds write. This can lead to memory corruption with potential for arbitrary code execution, denial of service, or other severe impacts. The vulnerability has a CVSS 3.1 score of 9.8, reflecting critical impact on confidentiality, integrity, and availability.

A fixed version of DBI (1.652 or later) should be used to remediate this vulnerability. Since no patch links or vendor advisory are provided, confirm the availability of the fix from the official DBI project or CPAN repository. Avoid processing untrusted, extremely large input statements on vulnerable 32-bit Perl DBI versions. Patch status is not yet confirmed in the provided data — check the vendor advisory for current remediation guidance.