CVE-2026-2597
Heap Buffer Overflow in Crypt::SysRandom::XS random_bytes() Function
Publication date: 2026-02-27
Last updated on: 2026-03-03
Assigner: CPANSec
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| leont | crypt | to 0.010 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-122 | A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). |
| CWE-1284 | The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
Crypt::SysRandom::XS versions before 0.010 for Perl contains a heap buffer overflow vulnerability in the XS function random_bytes().
The vulnerability occurs because the function does not check if the length parameter is non-negative. If a negative value is passed, an integer wraparound causes a zero-byte allocation.
Subsequently, the function that generates random bytes is called with the original negative value, which is interpreted as a very large unsigned number, leading to writes beyond the allocated buffer.
This results in heap memory corruption and can cause the application to crash, leading to denial of service.
Exploitation is less likely when the length argument is hardcoded, but applications passing untrusted input to this parameter may be vulnerable.
How can this vulnerability impact me? :
This vulnerability can lead to heap memory corruption and cause the affected application to crash, resulting in a denial of service.
If an attacker can supply a negative length parameter to the random_bytes() function, they may trigger this overflow and disrupt normal application operation.
However, if the length parameter is hardcoded and not influenced by untrusted input, the risk of exploitation is reduced.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know