The vulnerability arises from the preparse function in DBI versions prior to 1.652 for Perl, which calculates the output buffer size using a 32-bit STRLEN value. For input statements approximately 613 million bytes long, the multiplication used to reserve buffer space overflows and wraps around, causing the buffer to be allocated with only a few bytes. The parser then copies the entire large input into this undersized buffer without bounds checking, resulting in a heap out-of-bounds write. This flaw affects only 32-bit Perl builds because 64-bit builds use a wider STRLEN that prevents this wraparound at realistic input sizes.

An attacker who can supply an untrusted statement of sufficient length to the preparse function on a 32-bit Perl environment can trigger a heap out-of-bounds write with attacker-controlled data. This memory corruption could potentially lead to application crashes or exploitation, depending on the context in which DBI is used. 64-bit Perl builds are not affected due to the larger integer size preventing the overflow.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted input statements of extremely large size on 32-bit Perl builds using DBI versions before 1.652. Consider upgrading to 64-bit Perl environments where this issue does not manifest.