CVE-2026-88815

Katalog CVE

CVSS 6.2 · Medium EPSS 0,18%

Kerentanan Access of Resource Using Incompatible Type ('Type Confusion'). Skor CVSS 3.1 6.2 (Medium) menurut CISA ADP.

Deskripsi (NVD)

DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv. When casting to SQL_NUMERIC, sql_type_cast_svpv passes the string pointer and length of the SV to grok_number without stringifying it first. An integer (IV) or floating-point (NV) value has no valid string pointer, so grok_number reads from an invalid address, triggering a segmentation fault. This is reachable in Perl using the sql_type_cast function: my $num = 42; DBI::sql_type_cast( $num, DBI::SQL_NUMERIC, 0 );

Rincian

Terbit di NVD

28 September 2026

Terakhir diubah

30 September 2026

Status NVD

Deferred

CVSS 3.1

6.2 (Medium), sumber CISA ADP
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 7,3% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/perl5-dbi/dbi/commit/e5ad87e5602da995d28b4d65df222368b58d6702.patch
• https://github.com/perl5-dbi/dbi/security/advisories/GHSA-c8vq-w3wr-6979
• https://metacpan.org/release/HMBRAND/DBI-1.654/changes
• http://www.openwall.com/lists/oss-security/2026/09/28/12