CVE-2026-10879: DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders

Synopsis

A heap buffer overflow exists in the Perl DBI module (versions before 1.648) triggered during SQL statement preparsing. The vulnerability is reachable over the network without any authentication or user interaction, as derived from the CVSS vector (AV:N/AC:L/PR:N/UI:N). Successful exploitation gives an attacker full read, write, and crash capabilities on the affected process, enabling data theft, data tampering, and remote code execution. A patched-image rebuild at DBI 1.648 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service must be reachable over the network; an attacker can trigger the overflow by sending a crafted SQL statement remotely.

• AuthenticationNot required

  No credentials or session token are needed; the overflow is reachable by any unauthenticated caller.

• Victim interactionNot required

  No victim action is required; the attacker triggers the overflow entirely through their own requests.

• Attack complexityDetail

  Exploit complexity is low: the overflow is deterministic and condition-free, requiring only a SQL statement with 10 or more placeholder binders to exceed the allocated buffer.

Blast Radius

• Reads arbitrary heap memory from the DBI process, exposing in-flight query data, credentials, and application secrets.
• Overwrites heap structures to corrupt application state or pivot to controlled data, enabling modification of database rows or session records.
• Crashes the DBI process or the Perl interpreter hosting it, taking the database-connected application offline.
• Under favorable heap layout, achieves remote code execution within the process, giving the attacker full control of the application runtime.