Two Perl ExtUtils typemap CVEs can misread memory or exhaust it
Robert Rothenberg disclosed two Perl ExtUtils typemap flaws that can misread an SV length or allocate 32 GiB for an empty list.
On 10 October 2026, Robert Rothenberg reported two vulnerabilities in Perl modules shipped with ExtUtils-Typemaps-Default on oss-security. CVE-2026-107373 affects ExtUtils::Typemaps::STL::String before 1.06: the T_STD_STRING typemap may read a Perl SV's length before the argument is stringified, which can cause incorrect memory access. CVE-2026-107794 affects ExtUtils::Typemaps::STL::List before 1.07, which allocates a 32 GiB array when handling an empty list and can exhaust memory. Neither post describes exploitation in the wild. The reports do not disagree on versions, impact, or disclosure details.
- CVE-2026-107373 affects ExtUtils::Typemaps::STL::String before 1.06, part of ExtUtils-Typemaps-Default.
- The T_STD_STRING typemap may read a Perl SV length before stringifying the argument, which can cause incorrect memory access.
- CVE-2026-107794 affects ExtUtils::Typemaps::STL::List before 1.07, distributed with ExtUtils-Typemaps-Default.
- Handling an empty list allocates a 32 GiB array and can exhaust memory.
- Robert Rothenberg disclosed both issues on oss-security on 2026-10-10.
- Neither report describes exploitation in the wild.
Coverage timelineoldest first · each row is one article
- · 6d agoCVE-2026-107373: ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument
oss-security· 26
Perl ExtUtils::Typemaps::STL::String before 1.06 may read an SV length before stringifying arguments.
- · 6d agoCVE-2026-107794: ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list
Perl ExtUtils::Typemaps::STL::List before 1.07 allocates a 32 GiB array for an empty list.
Vulnerabilities in this storyAll →
- CVE-2026-1073739.1—Out-of-bounds read in ExtUtils::Typemaps::STL::Stringpublished · CPAN ExtUtils::Typemaps::STL::String+1 related
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
CVE-2026-107373+1 related CVE | Out-of-bounds read in ExtUtils::Typemaps::STL::String ExtUtils::Typemaps::STL::String before 1.06 provides a T_STD_STRING typemap that builds a C++ std::string with std::string(SvPV_nolen($arg), SvCUR($arg)). C++ does not define argument evaluation order, so some compilers may evaluate SvCUR before SvPV_nolen has stringified the Perl SV. If the argument is not already a string—an integer, number, or reference—SvCUR can return an invalid length and the process may abort or segfault (CWE-125, out-of-bounds read). Perl XS or C++ bindings generated from this typemap are affected when non-string values reach that conversion; the practical impact described is a crash, not confirmed code execution. There is no known public proof of concept, no confirmed in-the-wild exploitation, no CVSS score yet, and the issue is not on the CISA KEV list. |