Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-73194— DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse

Quick assessment

Affected
CVE-2026-73194
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是对该漏洞描述信息的中文翻译： Perl 的 DBI 模块在 1.652 版本之前存在一个堆越界写入漏洞，该漏洞可通过一个未经验证的数值占位符触发，该占位符会在预解析阶段设置绑定计数器（binder counter）。 预解析函数（preparse）为每个输入字节预留 7 个输出字节，这是最长形式的 占位符展开后的宽度。 分支使用 解析数字，并将其赋值给绑定计数器，且未进行任何范围检查。因此，包含 的 SQL 语句会导致计数器变为负数（在 glibc 环境下，由于 发生溢出回绕，计数器值为 -214748364

AI Predicted 7.8 Difficulty: Moderate EPSS 0.49% · P41

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None < 1.652 affected

I. Basic Information for CVE-2026-73194

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse
Source: CVE Program / CVE List V5
Vulnerability Description
DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse. preparse reserves seven output bytes per input byte, the width of the longest ':p99999' expansion. The ':N' branch parses the number with `atoi(src)` and assigns it to the binder counter with no range check, so a statement containing ':2147483648' leaves the counter negative (-2147483648 with glibc, where atoi wraps). Each following '?' then expands through `sprintf(start, ":p%d", idx++)` to ':p-2147483648', 14 bytes with the terminating NUL where the buffer budgets 7. The placeholder limit added in 1.650 tests the counter against 99,999, which a negative counter passes. Any caller that preparses an untrusted statement into ':pN' style placeholders gets a heap out-of-bounds write that grows with the number of '?' marks following the poisoned placeholder. The '?' and '%s' return styles compare the parsed number against the expected sequence and error out, and are unaffected.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1284
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 1.652 -

II. Public POCs for CVE-2026-73194

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-73194

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-73194 (1)

Vendor Advisories for CVE-2026-73194 (1)

News Coverage for CVE-2026-73194 (1)

Other References for CVE-2026-73194 (1)

IV. Related Vulnerabilities

Same weakness: CWE-1284

V. Comments for CVE-2026-73194

No comments yet

Leave a comment