Heap Out-of-Bounds Write in DBD::Pg for Perl

CVE-2026-78183

What is CVE-2026-78183?

The DBD::Pg Perl module version 3.21.0 has a vulnerability that allows for a heap out-of-bounds write due to improper handling of special numeric literals in the quote_float() function. Specifically, this function incorrectly allocates memory for literals such as NaN, Inf, and Infinity, leading to an overflow by 2 bytes. This flaw can potentially be exploited through the $dbh->quote method, resulting in memory corruption and unpredictable behavior. This issue was introduced in version 3.21.0 following a rewrite of quote.c.

References