The vulnerability in Net::IDN::Punycode (CVE-2026-74766) is a heap use-after-free in the XS backend's decode_punycode function. The function calculates the insertion pointer before growing the output buffer, which reallocates memory and invalidates the insertion pointer. Subsequent writes use this stale pointer, leading to use-after-free conditions. This flaw was introduced in version 2.301 and persists in all versions before 2.590. The issue arises when decoding punycode labels containing code points above U+FFFF, which require more bytes than initially allocated, triggering buffer reallocation.

An attacker can cause the application to read from and write to freed heap memory by supplying a malicious punycode label. This can lead to memory corruption, potentially causing crashes or undefined behavior. The exact impact depends on how the affected library is used, but use-after-free vulnerabilities can be leveraged for denial of service or potentially arbitrary code execution in some contexts.

Users should upgrade Net::IDN::Punycode to version 2.590 or later where this vulnerability is fixed. No vendor advisory is provided in the input, but the affected version range indicates that versions before 2.590 are vulnerable and presumably fixed in 2.590. Until upgrading, avoid processing untrusted punycode labels with the XS backend. Patch status is not explicitly confirmed by a vendor advisory; check the official Net::IDN::Punycode release notes or CPAN for confirmation and updates.