Heap Out-of-Bounds Read in Perl Product by Leont

CVE-2026-8463

What is CVE-2026-8463?

A vulnerability in Crypt::Argon2 versions up to 0.030 allows for an out-of-bounds read when the argon2_verify function is called with empty encoded input. The function uses encoded_len - 1 as the argument for memchr without validating that the encoded length is greater than zero. If the encoded string is empty, this leads to an underflow error, causing memchr to examine adjacent heap memory. As a result, an attacker may exploit this to crash the process or expose sensitive data such as the position of a '$' byte, potentially compromising security.

References