The HMBRAND DBI Perl module versions prior to 1.648 contain a buffer overflow vulnerability (CWE-787) in error handling. Specifically, error messages returned when RaiseError, PrintError, or HandleError are set are written into a 200-byte buffer without length checks, allowing an attacker who can control error text to overflow the buffer. This can lead to arbitrary code execution. Red Hat's advisory confirms the issue and provides updated packages for Red Hat Enterprise Linux 10 to remediate the vulnerability. The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating network exploitable with low attack complexity, no privileges or user interaction required, no confidentiality or integrity impact, but high impact on availability.

The vulnerability allows remote attackers to cause a buffer overflow by influencing error messages in the DBI Perl module, potentially leading to arbitrary code execution. The CVSS score reflects a high impact on availability, with no direct confidentiality or integrity impact. Exploitation does not require privileges or user interaction. No known exploits have been reported in the wild so far.

Red Hat has released security updates for perl-DBI in Red Hat Enterprise Linux 10 that fix this vulnerability. Users should apply these official patches as detailed in the Red Hat advisory (RHSA-2026:38513) to remediate the issue. Since this is a code execution vulnerability via buffer overflow, updating to the fixed version is the recommended mitigation. Patch status is confirmed by the vendor advisory. No alternative mitigations or workarounds are specified.