CVE-2026-9334 affects Cpanel::JSON::XS versions prior to 4.41. When the dupkeys_as_arrayref option is enabled, the decode_hv() function collapses duplicate JSON object keys into an array reference. However, the code incorrectly evaluates SvRV(old_value) before confirming old_value is a reference, causing a type confusion. This results in dereferencing a non-reference scalar as a reference, which can crash the caller decoding untrusted JSON and lead to incompatible memory access based on attacker-controlled data.

An attacker supplying crafted JSON with duplicate keys can cause the decoder to crash due to type confusion. This may lead to denial of service and potentially memory corruption or other undefined behavior due to dereferencing invalid pointers derived from attacker-controlled scalar contents. The CVSS score of 7.3 indicates high severity with network attack vector, no privileges required, and impacts confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should avoid enabling dupkeys_as_arrayref when decoding untrusted JSON until an official fix is available. Monitor vendor channels for updates and apply any official patches once released.