CVE-2026-2474: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-2474 is a heap-based buffer overflow vulnerability in the Crypt::URandom Perl module affecting versions 0.41 through 0.54 (before 0.55). The flaw resides in the XS function crypt_urandom_getrandom(), which fails to validate that the length parameter is non-negative, leading to integer wraparound and heap memory corruption. It was disclosed on February 16, 2026, with a patch available in version 0.55. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-122 (Heap-based Buffer Overflow), CWE-1284 (Improper Validation of Specified Quantity in Input), and CWE-839 (Numeric Range Comparison Without Minimum Check). When a negative value (e.g., -1) is passed as the length parameter to crypt_urandom_getrandom(), the expression length + 1u triggers an integer wraparound due to signed/unsigned arithmetic, resulting in a zero-byte heap allocation. The subsequent getrandom(data, length, GRND_NONBLOCK) syscall receives the original negative value, which is implicitly cast to a very large unsigned integer (typically SIZE_MAX), causing writes far beyond the allocated buffer boundary and corrupting heap memory (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation results in heap memory corruption and application crash, constituting a denial-of-service (DoS) condition. There is no known confidentiality or integrity impact — the CVSS vector reflects High availability impact only. In typical deployments, the length argument is hardcoded by the caller, significantly limiting attacker-controlled exploitation; however, applications that pass untrusted user input to this parameter face elevated risk of service disruption (Red Hat Bugzilla, Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.028% (0.000280), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is further constrained by the fact that the vulnerable parameter is typically hardcoded in common usage patterns, requiring attacker control over the length argument to trigger the flaw (Red Hat Advisory, Red Hat Bugzilla).

The primary remediation is to update Crypt::URandom to version 0.55 or later, which introduces proper validation of the length parameter. For applications that cannot be immediately patched, implement input validation to ensure the length argument passed to crypt_urandom_getrandom() is always non-negative and does not originate from untrusted sources. Fedora and openSUSE have issued updated packages addressing this vulnerability (Red Hat Advisory, openSUSE Advisory).

Red Hat tracked the vulnerability via its OSIDB system and assigned it medium severity. Fedora issued package updates for Fedora 42 and 43, and openSUSE published a security announcement. German Linux security outlet pro-linux.de covered the vulnerability across multiple updates. Community coverage has been limited, consistent with the low exploitability profile of the flaw (Red Hat Advisory, openSUSE Advisory).