Perl ExtUtils::Typemaps::Default: Out-of-bounds read in T_STD_STRING typemap
Summary
ExtUtils::Typemaps::Default before version 1.06 generates code for the T_STD_STRING typemap that may read the length of a Perl scalar before converting it to a string. If the argument is not a string, for example a number or a reference, the length read can be invalid. This can make the affected program abort or crash. The problem is triggered when such values reach XS functions built with this typemap, so exposure depends on the software in use; the impact is mainly availability.
Affected
- ExtUtils::Typemaps::Default versions before 1.06
- Perl XS modules built with an affected version
Fixed in
- Version 1.06 or later
Workaround
- No vendor workaround is documented for systems that cannot be upgraded.
- Ensure that arguments passed to affected modules are strings, or validate argument types before the call.
Exploitation
- No known exploitation.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
Our recommendation
- Identify Perl installations and XS modules that use ExtUtils::Typemaps::Default, including custom software.
- Update to version 1.06 or later and rebuild dependent modules.
- Install the distribution updates for OS-managed Perl packages.
- Where patching is not possible, validate input types before they reach affected functions.
- The CVSS score of 9.1 is disputed (Ubuntu rates it low), so prioritise by actual exposure.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Upstream commit a6b9c298 github.com
- MetaCPAN changelog ExtUtils-Typemaps-Default 1.06 metacpan.org
- Ubuntu security notice CVE-2026-107373 ubuntu.com
- OSV CVE-2026-107373 osv.dev
- Rapid7 Vulners CVE-2026-107373 vulners.com
- DevGuard vulnerability database CVE-2026-107373 docs.devguard.org
- CPAN RT bug 94110 rt.cpan.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:00.
Original description (NVD)
ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument. The typemap uses $var = std::string( SvPV_nolen($arg), SvCUR($arg) ) However, evaluation order for C++ arguments is not specified, and some compilers may produce code that evalutes SvCUR($arg) first. When $arg is not a string (for example, an interger, number or a reference) then SvCUR will return an invalid value, and the program may abort or segfault.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.