Perl versions before 3.41 contain a signed integer overflow vulnerability triggered during deserialization of a crafted SX_HOOK record. Specifically, retrieve_hook_common reads a signed 32-bit item count and calls av_extend with that count plus one. If the count is I32_MAX, the addition wraps to a negative value, causing av_extend to panic and terminate deserialization. This vulnerability affects multiple Ubuntu-packaged Perl versions as listed, potentially causing denial of service due to process termination.

Successful exploitation causes av_extend to receive a negative count, resulting in a panic that terminates the deserialization process. This leads to denial of service by crashing the Perl process handling the crafted input. There is no indication of code execution or data corruption beyond process termination.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor Ubuntu security advisories for updates addressing this vulnerability.