The vulnerability in DBI versions prior to 1.652 involves improper validation of a numeric placeholder that sets the binder counter in the preparse function. The preparse function reserves seven output bytes per input byte, but the numeric parsing uses atoi without range checking. When a large number such as ':2147483648' is used, the binder counter wraps to a negative value (-2147483648 with glibc). Subsequent '?' placeholders expand into ':p-2147483648', which exceeds the buffer allocation, causing a heap out-of-bounds write. The placeholder limit introduced in version 1.650 checks the counter against 99,999, but negative values bypass this check. This vulnerability affects any caller that preparses untrusted statements into ':pN' style placeholders, potentially leading to heap corruption. The '?' and '%s' return styles are unaffected as they perform additional checks.

This vulnerability allows an attacker to cause a heap out-of-bounds write, which can lead to memory corruption and potentially denial of service or other undefined behavior. The CVSS score of 9.1 reflects a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's announcements for updates. Avoid preparsing untrusted statements containing numeric placeholders until a fix is available.