Heap Buffer Overflow in Perl's Crypt::SysRandom::XS by Leont

CVE-2026-2597

What is CVE-2026-2597?

The Crypt::SysRandom::XS module for Perl versions prior to 0.010 contains a vulnerability where the XS function random_bytes() does not validate its length parameter. Supplying a negative value can lead to integer overflow, resulting in a zero-byte allocation. This causes the application to invoke randomness functions with excessive memory requirements, potentially leading to heap memory corruption and application instability. While typical usage involves hardcoded length values, applications that utilize untrusted inputs may be at risk of denial of service through this exploit.

References