by Kastro
Paper/Archive/CVE-2026-107373

CVE-2026-107373

CPANSec — ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument

EPSS 0.4%CVSS 9.1
critical.is priorityof 100
34
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 32.7.327 × 206.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument. The typemap uses $var = std::string( SvPV_nolen($arg), SvCUR($arg) ) However, evaluation order for C++ arguments is not specified, and some compilers may produce code that evalutes SvCUR($arg) first. When $arg is not a string (for example, an interger, number or a reference) then SvCUR will return an invalid value, and the program may abort or segfault.

Affected

ProductAffectedFixed inSource
ExtUtils-Typemaps-Default< 1.061.06CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refmetacpan.org/release/SMUELLER/ExtUtils-Typemaps-Default-1.06/changesrefgithub.com/tsee/extutils-typemap-default/commit/a6b9c298b34ddadc582961403e715d292f82a22drefrt.cpan.org/Public/Bug/Display.html?id=94110refcve.org/CVERecord?id=CVE-2026-80490