CVE-2026-88815

Name of the Vulnerable Software and Affected Versions DBI versions prior to 1.654

Description Numeric values are incorrectly treated as strings in the sql type cast svpv function. When casting to SQL NUMERIC, the sql type cast svpv function passes the string pointer and length of the SV to grok number() without first stringifying it. Because integer (IV) or floating-point (NV) values lack a valid string pointer, grok number() reads from an invalid address, resulting in a segmentation fault. This issue can be triggered using the sql type cast() function.

Recommendations Update DBI to version 1.654 or later.