CVE-2026-107373: ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument

ExtUtils::Typemaps::STL::String before 1.06 provides a T_STD_STRING typemap that builds a C++ std::string with std::string(SvPV_nolen($arg), SvCUR($arg)). C++ does not define argument evaluation order, so some compilers may evaluate SvCUR before SvPV_nolen has stringified the Perl SV. If the argument is not already a string—an integer, number, or reference—SvCUR can return an invalid length and the process may abort or segfault (CWE-125, out-of-bounds read). Perl XS or C++ bindings generated from this typemap are affected when non-string values reach that conversion; the practical impact described is a crash, not confirmed code execution. There is no known public proof of concept, no confirmed in-the-wild exploitation, no CVSS score yet, and the issue is not on the CISA KEV list.