CVE-2026-88815: DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv

Perl DBI before 1.654 has a type-confusion flaw (CWE-843) in sql_type_cast_svpv. When a value is cast to SQL_NUMERIC, the function hands the scalar’s string pointer and length to grok_number without stringifying it first, so an integer or floating-point value—which has no valid string buffer—is read from an invalid address and the process segmentation-faults. That path is reachable through DBI::sql_type_cast, and untrusted input that drives a numeric value into this cast can crash the Perl process (denial of service); the report does not describe code execution or data theft. Anyone running DBI before 1.654 in an application that reaches this cast, directly or through a DBD driver, is affected. There is no known public proof-of-concept, the issue is not on the CISA KEV list, and CVSS has not yet been scored.