CVE-2026-73193

Name of the Vulnerable Software and Affected Versions DBI versions prior to 1.652

Description On 32-bit Perl builds, an integer wraparound occurs in the output buffer size calculation within the preparse() function. The buffer is reserved using newSV(strlen(statement) * 7 + 16), where the product is computed using a 32-bit STRLEN. A statement of approximately 613,566,757 bytes causes the calculation to wrap modulo 2^32, resulting in a significantly smaller memory allocation. Subsequently, the parser copies the input via a raw pointer without capacity checks, leading to a heap out-of-bounds write of attacker-controlled bytes. This issue is not present in 64-bit builds.

Recommendations Update to version 1.652 or later.