Out-of-Bounds Heap Read in Socket for Perl by Perl

CVE-2026-12087

What is CVE-2026-12087?

The Socket module in Perl has a vulnerability where the function pack_ip_mreq_source() performs inadequate validation on its source argument. Specifically, it checks the byte length based on a prior multiaddr argument instead of validating the source argument directly. This oversight allows a source of an arbitrary length to pass through, potentially leading to an out-of-bounds read. As a result, copying a source value shorter than 4 bytes can expose sensitive adjacent heap memory, creating potential security risks.

References