CVE-2026-78183: CWE-787 Out-of-bounds Write

DBD::Pg 3.21.0 for Perl contains a heap out-of-bounds write in the quote_float function. The function allocates memory based on the length of the string plus one byte for the NULL terminator, which is correct for normal numeric values. However, for special literals like NaN, Inf, +Inf, -Inf, Infinity, +Infinity, and -Infinity, the function emits the literal surrounded by quotes plus a NULL terminator, requiring length plus three bytes. This mismatch causes a 2-byte overflow (one quote and one NULL) on the heap. The vulnerability can be exploited by calling $dbh->quote with these special literals and the DBI::SQL_NUMERIC type. This regression was introduced in version 3.21.0 during a rewrite of quote.c.

Successful exploitation of this vulnerability can lead to heap corruption, which may result in arbitrary code execution, denial of service, or data corruption. The CVSS score of 9.8 reflects the critical nature of this flaw with high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported at this time.

No official patch or remediation is currently available for this vulnerability. Users should avoid using DBD::Pg version 3.21.0, especially the quote_float function with special floating-point literals, until a fix is released. Monitor the vendor or CPAN security advisories for updates and apply official patches once available.