Stack Buffer Overflow in CryptX for Perl Affects Multiple Decrypt Verify Helpers

CVE-2026-41565

What is CVE-2026-41565?

A stack buffer overflow vulnerability exists in CryptX versions prior to 0.088_001 for Perl, specifically affecting four AEAD decrypt_verify helper routines: gcm_decrypt_verify, ccm_decrypt_verify, chacha20poly1305_decrypt_verify, and eax_decrypt_verify. These routines erroneously copy the caller-supplied authentication tag into a fixed-size 144-byte stack buffer without validating the length of the supplied tag. If an attacker provides a longer tag than the buffer can accommodate, it leads to an overflow, potentially allowing the attacker to manipulate the stack and execute arbitrary code. The vulnerability was addressed in version 0.088 with the addition of a length check for gcm_decrypt_verify, and this was further reinforced in version 0.088_001 for the remaining routines.

References