CVE-2026-12844

Name of the Vulnerable Software and Affected Versions List::SomeUtils::XS versions prior to 0.59

Description A heap buffer overflow exists in the pairwise() function. The function collects values returned by a block into a heap buffer sized according to the longer input array. When the buffer needs to grow, it uses a single quadrupling operation (alloc <<= 2) instead of a loop. If a block call returns more than four times the current allocation in a single invocation, the copy operation writes past the end of the buffer, leading to heap corruption.

Recommendations Update List::SomeUtils::XS to version 0.59 or later. As a temporary mitigation, avoid using the pairwise() function if the block returns values exceeding four times the length of the longer input array.