CVE-2026-78183 is a heap out-of-bounds write vulnerability in DBD::Pg 3.21.0 for Perl, specifically in the quote_float function. The function allocates memory based on the length of the string plus one byte for the NULL terminator, which is sufficient for normal numeric values. However, for special floating-point literals like NaN, Inf, +Inf, -Inf, Infinity, +Infinity, and -Infinity, the function emits the literal surrounded by quotes plus a NULL terminator, requiring length plus three bytes. This mismatch causes an overflow by 2 bytes (a single quote and a NULL byte) on the heap. The vulnerability can be exploited by calling the $dbh->quote method with these special literals. This regression was introduced in version 3.21.0 following a rewrite of the quote.c source file.

The heap out-of-bounds write can lead to memory corruption, which may cause application crashes or potentially enable arbitrary code execution depending on the context in which the vulnerable function is used. However, no known exploits are reported in the wild at this time.

No official fix or patch has been published yet for this vulnerability. Users should avoid using version 3.21.0 of DBD::Pg or refrain from quoting special floating-point literals such as NaN, Inf, and Infinity using the $dbh->quote method until a patch is released. Monitor the vendor or CPAN security advisories for updates and apply official fixes once available.