The vulnerability exists in the XS routine backing HTML::Entities::_decode_entities in versions before 3.84. It involves caching a pointer into the entity-value SV returned by hv_fetch on the entity2char hash. When the input SV matches a value SV containing its own key as an entity reference, a subsequent grow_gap() call reallocates the SV's PV buffer and frees the original allocation that the cached pointer references. This leads to reading freed heap memory during a copy loop, potentially disclosing adjacent heap contents into the destination SV. This is a use-after-free read vulnerability affecting specific versions of libhtml-parser-perl used in Ubuntu distributions.

The vulnerability allows an attacker to read freed heap memory, which may disclose adjacent heap contents. This can lead to information disclosure (confidentiality impact) but does not affect integrity or availability. There are no known exploits in the wild as of the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor official Ubuntu security advisories for updates or patches addressing this issue. Until a patch is available, avoid processing untrusted input with affected versions of HTML::Entities to reduce risk.