CVE-2026-8829 describes a use-after-free vulnerability (CWE-416) in the HTML::Entities Perl module prior to version 3.84. The XS routine backing _decode_entities caches a pointer into an entity-value SV obtained from the entity2char hash. When the input SV matches a value SV in that hash and that value contains its own key as an entity reference, a subsequent grow_gap() call reallocates the SV's PV buffer, freeing the original allocation that the cached pointer references. The later copy operation reads from this freed memory, potentially disclosing adjacent heap contents into the destination SV.

The vulnerability allows an attacker to read freed heap memory, which may disclose sensitive adjacent heap contents. The CVSS score of 7.5 reflects a high confidentiality impact with no impact on integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is currently available. Users should monitor for updates from the OALDERS project or CPAN security advisories and apply any forthcoming patches promptly.