Executive brief
The Socket library for the Perl programming language, which handles low-level networking tasks, contains a flaw that can lead to unintended data exposure. An attacker or a malicious script could exploit this to read small amounts of private information from the computer's memory that should not be accessible. This could potentially reveal sensitive fragments of data from other operations running on the same system.
Technical details
An out-of-bounds heap read exists in Socket.xs within the pack_ip_mreq_source() function. The vulnerability is caused by the reuse of a length variable (`STRLEN len`) that incorrectly validates the source argument using the length of the preceding multiaddr argument. Because both fields are 4 bytes, a valid multiaddr allows a source argument shorter than 4 bytes to pass the length check. When the function performs a fixed-size copy into the 4-byte imr_sourceaddr field, it reads up to 3 bytes beyond the source buffer's end, leaking adjacent heap memory into the returned packed structure. This issue was resolved in version 2.041.
Affected products
- Perl Socket < 2.041
Timeline
- 2026-03-26: patched: Version 2.041 released to CPAN
- 2026-06-15: disclosed: CVE-2026-12087 published