The vulnerability CVE-2026-12087 affects the perl-Socket module used in Red Hat Hardened Images. Specifically, the pack_ip_mreq_source() function performs incorrect length validation, leading to an out-of-bounds heap read. An attacker supplying specially crafted input can cause the function to read memory beyond the allocated buffer, potentially exposing sensitive information such as cryptographic keys or memory addresses. This can aid in bypassing protection mechanisms like ASLR. The vulnerability is limited to information disclosure and requires the vulnerable function to be called with attacker-controlled input. Red Hat has issued an advisory (RHSA-2026:11342) describing the issue but has not released a patch or fix for affected products. The affected RPMs include perl-Socket-2.041-1.hum1 for aarch64 and x86_64 architectures.

The vulnerability allows out-of-bounds heap reads that can disclose a few bytes of adjacent memory, potentially leaking sensitive information such as cryptographic keys or memory addresses. This information disclosure could assist attackers in bypassing security mechanisms like ASLR. There is no impact on integrity or availability reported. Exploitation requires attacker-controlled input to the affected function, which limits the practical impact. No known exploits are reported in the wild.

Currently, no mitigation or patch is available that meets Red Hat's criteria for ease of use, deployment, and stability. Users should monitor Red Hat advisories for any future updates. Since the vulnerability requires specific application behavior to be exploitable, limiting exposure to untrusted input to the perl-Socket module may reduce risk. Customers with Red Hat Technical Account Managers can seek guidance directly. No urgent remediation is available at this time.