Heap Buffer Overflow in JSON::XS for Perl

CVE-2026-129114

What is CVE-2026-129114?

The JSON::XS module for Perl contains a vulnerability where it writes one byte past a heap buffer when appending a one-byte chunk during the incr_parse operation. This occurs due to improper handling of the buffer size, allowing a potential attacker to exploit this flaw. By streaming data in a specific manner, an attacker can cause an out-of-bounds write, which could lead to undefined behavior, including potential code execution or application crashes.

References