The vulnerability in DBI versions before 1.648 involves an out-of-bounds write (CWE-787) due to unchecked copying of error messages into a fixed-size buffer. When RaiseError, PrintError, or HandleError are set, error messages exceeding 200 bytes can overflow the buffer. Although the attacker cannot control the exact overflow location, this can lead to memory corruption causing denial of service or potentially arbitrary code execution. Red Hat's advisory confirms the vulnerability and notes that no effective mitigation other than restricting access to affected applications is currently available. Red Hat has issued updated perl-DBI packages (version 1.643-26.el10_2.1 and later) for Red Hat Enterprise Linux 10 to fix this issue.

The vulnerability allows remote attackers to cause a denial of service by crashing applications using perl-DBI through buffer overflow in error handling. There is also a potential for arbitrary code execution, although exploitation is complicated by lack of control over overflow location. The CVSS 3.1 base score is 7.5 (high), reflecting network attack vector, low complexity, no privileges or user interaction required, and high impact on availability. Confidentiality impact is none, integrity impact is low, and availability impact is high. No known exploits in the wild have been reported.

A vendor-provided official fix is available via updated perl-DBI packages from Red Hat for Red Hat Enterprise Linux 10 and its variants. Users should apply these updates promptly. Until patched, users are advised to restrict access to network-exposed applications using perl-DBI to trusted users only. No other effective mitigations meeting Red Hat's criteria are currently available.