Search: CVE-2026-41565

CryptX versions prior to 0.088_001 for Perl contain a stack-based buffer overflow vulnerability in four AEAD decrypt_verify helper functions. These functions copy an attacker-controlled authentication tag into a fixed 144-byte stack buffer without validating the tag length, allowing an overflow if the tag is longer. The issue affects gcm_decrypt_verify, ccm_decrypt_verify, chacha20poly1305_decrypt_verify, and eax_decrypt_verify XS routines. Version 0.088 introduced a clamp to gcm_decrypt_verify, and 0.088_001 added clamps to the other three functions to prevent this overflow. No official patch or remediation guidance is currently documented in the vendor advisory or patch links.