Threats Tagged 'cve-2026-73194'

This security update provides a functional equivalent of RHSA-2026:71608. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2026:71608.

CVE-2026-73193 is a critical integer overflow vulnerability in DBI for Perl versions before 1.652 on 32-bit Perl builds. It allows a heap out-of-bounds write due to an integer wraparound in the output buffer size calculation in the preparse function. This occurs when processing very large input statements, leading to memory corruption. 64-bit Perl builds are not affected. The vulnerability has a CVSS score of 9.8, indicating high severity.

DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse. preparse reserves seven output bytes per input byte, the width of the longest ':p99999' expansion. The ':N' branch parses the number with `atoi(src)` and assigns it to the binder counter with no range check, so a statement containing ':2147483648' leaves the counter negative (-2147483648 with glibc, where atoi wraps). Each following '?' then expands through `sprintf(start, ":p%d", idx++)` to ':p-2147483648', 14 bytes with the terminating NUL where the buffer budgets 7. The placeholder limit added in 1.650 tests the counter against 99,999, which a negative counter passes. Any caller that preparses an untrusted statement into ':pN' style placeholders gets a heap out-of-bounds write that grows with the number of '?' marks following the poisoned placeholder. The '?' and '%s' return styles compare the parsed number against the expected sequence and error out, and are unaffected.