ExtUtils::Typemaps::STL::String

CVE-2026-107373: ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument

Perl ExtUtils::Typemaps::STL::String before 1.06 may read an SV length before stringifying arguments.

Robert Rothenberg reported CVE-2026-107373 on oss-security for Perl's ExtUtils::Typemaps::STL::String, part of ExtUtils-Typemaps-Default. Versions before 1.06 may read a Perl SV's length in the T_STD_STRING typemap before the argument is stringified, which can cause incorrect memory access. The post does not describe exploitation in the wild.

oss-security·Oct 10, 13:45 UTC · 6d agoVulnerability 2 sourcesCVE-2026-1073731