CVE-2026-73194

Name of the Vulnerable Software and Affected Versions DBI versions prior to 1.652

Description An issue exists where an unvalidated numeric placeholder can trigger a heap out-of-bounds write during the preparse process. The process reserves seven output bytes per input byte, based on the maximum width of a :p99999 expansion. However, the :N branch uses the atoi() function to parse numbers and assigns the result to the binder counter without a range check. If a statement contains a value such as :2147483648, the counter can wrap to a negative value. Subsequent ? marks are then expanded using sprintf() into strings like :p-2147483648, which require 14 bytes, exceeding the allocated 7-byte buffer. This occurs when untrusted statements are preparsed into :pN style placeholders. The ? and %s return styles are not affected as they validate the parsed number against the expected sequence.

Recommendations Update to version 1.652 or later.