CVE-2026-107373

Deferred Deferred - Pending Action

Memory Corruption in ExtUtils::Typemaps::STL::String Perl Module

Publication date: 2026-10-10

Last updated on: 2026-10-16

Assigner: CPANSec

Description

ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument. The typemap uses $var = std::string( SvPV_nolen($arg), SvCUR($arg) ) However, evaluation order for C++ arguments is not specified, and some compilers may produce code that evalutes SvCUR($arg) first. When $arg is not a string (for example, an interger, number or a reference) then SvCUR will return an invalid value, and the program may abort or segfault.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-10

EPSS Evaluated

2026-10-18

NVD

CVE-2026-107373

EUVD

EUVD-2026-96314

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability affects ExtUtils::Typemaps::STL::String versions before 1.06 for Perl. It involves a typemap issue where the SV length is read before stringifying the argument. The code uses $var = std::string( SvPV_nolen($arg), SvCUR($arg) ), but C++ argument evaluation order is not specified. Some compilers may evaluate SvCUR($arg) first, leading to invalid values if $arg is not a string, causing program aborts or segfaults.

Detection Guidance

To detect this vulnerability, check if your system uses ExtUtils::Typemaps::STL::String versions before 1.06. Run: perl -MCPAN -e 'print $ExtUtils::Typemaps::STL::String::VERSION' to check the installed version.

Impact Analysis

If you use affected versions of ExtUtils::Typemaps::STL::String, your Perl program may crash or segfault when processing non-string arguments. This could lead to denial of service or unexpected termination of applications relying on this module.

Compliance Impact

This vulnerability causes program crashes or segmentation faults when processing non-string inputs, which could lead to denial of service or data processing failures. Such instability may impact compliance with GDPR's availability requirements or HIPAA's integrity principles by disrupting data handling operations.

Mitigation Strategies

Upgrade ExtUtils::Typemaps::STL::String to version 1.06 or later. Use: cpan ExtUtils::Typemaps::STL::String or cpanm ExtUtils::Typemaps::STL::String to update the module.

Hi! I’m here to help you understand CVE-2026-107373. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70