Critical severity · published Oct 10, 2026
CVE-2026-107373
ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument
9.1
CVSS
0.4%
EPSS
No
On KEV
Description
ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument.
The typemap uses
$var = std::string( SvPV_nolen($arg), SvCUR($arg) )
However, evaluation order for C++ arguments is not specified, and some compilers may produce code that evalutes SvCUR($arg) first.
When $arg is not a string (for example, an interger, number or a reference) then SvCUR will return an invalid value, and the program may abort or segfault.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-107373
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-107373
release-notes
https://metacpan.org/release/SMUELLER/ExtUtils-Typemaps-Default-1.06/changes
github.com
https://github.com/tsee/extutils-typemap-default/commit/a6b9c298b34ddadc582961403e715d292f82a22d
issue-tracking
https://rt.cpan.org/Public/Bug/Display.html?id=94110
related
https://www.cve.org/CVERecord?id=CVE-2026-80490
