Out-of-Bounds Read in Net::IDN::Punycode for Perl

CVE-2026-74765

What is CVE-2026-74765?

An out-of-bounds read vulnerability exists in the Net::IDN::Punycode module for Perl prior to version 2.590, caused by an integer overflow during the delta accumulation process. This vulnerability allows an attacker to exploit the XS backend, where the accumulation 'delta += (m-n) * (h+1)' lacks overflow checks. As a result, oversized code points can wrap the delta, leading to a potentially negative digit index, which bypasses established bounds checks. This misbehavior permits the encoding of malicious strings, enabling unauthorized data access by copying memory locations beyond the digit table range or even crashing the process.

References