Heap Use-After-Free Vulnerability in Perl's Net::IDN::Punycode

CVE-2026-74766

What is CVE-2026-74766?

A heap use-after-free vulnerability exists in the XS backend of Net::IDN::Punycode for Perl, introduced in version 2.301. This vulnerability allows an attacker to exploit the decoding of a maliciously crafted punycode label. The flaw occurs when the output buffer is reallocated without adequately updating the insertion pointer. As a result, subsequent memory reads and writes may occur through a freed pointer, which can lead to arbitrary code execution and potential compromise of system integrity.

References