{"id":"CVE-2026-107373","published":"2026-10-10T13:17:31.253","lastModified":"2026-10-16T16:16:57.310","description":"ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument.\n\nThe typemap uses\n\n    $var = std::string( SvPV_nolen($arg), SvCUR($arg) )\n\nHowever, evaluation order for C++ arguments is not specified, and some compilers may produce code that evalutes SvCUR($arg) first.\n\nWhen $arg is not a string (for example, an interger, number or a reference) then SvCUR will return an invalid value, and the program may abort or segfault.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","cwes":["CWE-125"],"vendors":[],"products":[],"references":[{"url":"https://github.com/tsee/extutils-typemap-default/commit/a6b9c298b34ddadc582961403e715d292f82a22d","tags":[]},{"url":"https://metacpan.org/release/SMUELLER/ExtUtils-Typemaps-Default-1.06/changes","tags":[]},{"url":"https://rt.cpan.org/Public/Bug/Display.html?id=94110","tags":[]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80490","tags":[]}],"exploitRefs":[{"url":"https://github.com/tsee/extutils-typemap-default/commit/a6b9c298b34ddadc582961403e715d292f82a22d","tags":[]}],"hasPoc":true,"ai":{"summary":"A buffer over-read vulnerability exists in ExtUtils::Typemaps::STL::String typemap where incorrect evaluation order can cause reading of invalid string length values when processing non-string arguments, potentially leading to program crashes or segmentation faults.","exploitability":"Exploitation is moderately difficult as it requires controlling the input to a Perl script that uses the affected typemap with non-string arguments, but the vulnerability can be triggered through standard Perl argument passing patterns.","blast_radius":"The impact could affect any Perl application using the ExtUtils::Typemaps::STL::String typemap with non-string arguments, potentially causing widespread application instability and crashes across systems running affected Perl modules.","remediation":"Upgrade to version 1.06 or later of ExtUtils::Typemaps::STL::String","detection":"No reliable host or network indicator is derivable from the published description.","tags":["buffer-overflow","perl","memory-corruption"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:48:21.157Z"}}