CVE-2026-107373: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-107373 is an out-of-bounds read vulnerability in ExtUtils::Typemaps::STL::String (part of the ExtUtils-Typemaps-Default Perl distribution) affecting versions before 1.06. The flaw exists in the T_STD_STRING typemap, which may read the SV (scalar value) length before stringifying the argument due to unspecified C++ argument evaluation order. It was published on October 10, 2026, with a patch available in version 1.06. The vulnerability carries a CVSS v3.1 base score of 9.1 (Critical) (Github Advisory, Red Hat Bugzilla).

The root cause is an unsafe C++ argument evaluation order in the T_STD_STRING typemap (CWE-125: Out-of-bounds Read). The vulnerable code constructs a std::string using $var = std::string( SvPV_nolen($arg), SvCUR($arg) ), where SvPV_nolen stringifies the Perl scalar and SvCUR returns its current length. Because the C++ standard does not specify the order in which function arguments are evaluated, some compilers may evaluate SvCUR($arg) before SvPV_nolen($arg) has had a chance to stringify the value. When $arg is a non-string type (integer, floating-point number, or reference), SvCUR returns an invalid or garbage length, potentially causing the program to read out-of-bounds memory, abort, or segfault (Github Advisory, GitHub Commit). The fix replaces the problematic construct with a two-step approach: first capturing the pointer and length via SvPV($arg, len), then constructing the std::string from those values (GitHub Commit).

Successful exploitation can cause the affected Perl application to abort or segfault, resulting in a denial of service condition. Additionally, because SvCUR may return an invalid length causing an out-of-bounds memory read, there is a potential for unintended memory disclosure (confidentiality impact rated High in the CVSS score). Any caller — including unauthenticated network users if the vulnerable typemap is exposed through a network-accessible Perl application — can trigger the crash by passing a non-string argument (integer, number, or reference) where a string is expected (Github Advisory, Red Hat Bugzilla).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.187%, placing it in the 8th percentile for exploitation likelihood within 30 days. The NVD SSVC assessment classifies exploitation as "none" and the attack as automatable, meaning a network attacker could potentially trigger the flaw without manual interaction if the vulnerable code path is reachable (Github Advisory).

1. Identify target: Locate a network-accessible Perl application that uses ExtUtils::Typemaps::STL::String (part of ExtUtils-Typemaps-Default < 1.06) and exposes a function or API endpoint that accepts user-supplied input mapped through the T_STD_STRING typemap.
2. Craft non-string input: Prepare a request that passes a non-string value — such as an integer, floating-point number, or a reference — to a parameter that the application expects to be a string and passes through the vulnerable typemap.
3. Submit the malicious input: Send the crafted request to the target application endpoint (e.g., via HTTP POST/GET if web-facing, or via any other protocol the application uses).
4. Trigger the out-of-bounds read: The vulnerable typemap evaluates SvCUR($arg) before SvPV_nolen($arg) stringifies the value (compiler-dependent), causing SvCUR to return an invalid length and the std::string constructor to read out-of-bounds memory.
5. Achieve denial of service (or memory disclosure): The application aborts or segfaults due to the invalid memory access, causing a denial of service; in some compiler/platform combinations, out-of-bounds memory contents may be returned to the caller (Github Advisory, GitHub Commit).

• Logs: Application logs showing unexpected crashes, segmentation faults, or abort signals in Perl processes using XS/C++ extensions; error messages referencing ExtUtils::Typemaps::STL::String or T_STD_STRING.
• Process: Perl interpreter or application process terminating abnormally (exit code indicating signal, e.g., SIGSEGV or SIGABRT) when processing non-string input.
• Network: Repeated requests to application endpoints with integer, numeric, or reference-type values in fields expected to be strings, particularly if followed by application restarts or error responses.

Upgrade ExtUtils-Typemaps-Default to version 1.06 or later, which fixes the unsafe argument evaluation by using SvPV($arg, len) to atomically capture both the string pointer and its length before constructing the std::string (GitHub Commit, Github Advisory). As a workaround prior to patching, applications can add input validation to ensure only string-type values are passed to functions using the T_STD_STRING typemap. Red Hat has tracked this issue in their bugzilla for affected packages (Red Hat Bugzilla).

The vulnerability was reported via the CPAN bug tracker (RT ticket #94110) and assigned by CPANSec. Red Hat opened a security response bug (BZ#2548972) and classified it as medium severity for their products. No significant broader media coverage or notable researcher commentary beyond standard vulnerability database entries has been observed.