# CVE-2026-12087: Perl Socket out-of-bounds heap read in pack_ip_mreq_source

Source: https://junglewise.ai/threats/cve-2026-12087-perl-socket-out-of-bounds-heap-read-in-pack-ip-mreq-source  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2026-12087 · Severity: info · CVSS 3.7 · Published 2026-06-15

The Socket library for the Perl programming language, which handles low-level networking tasks, contains a flaw that can lead to unintended data exposure. An attacker or a malicious script could exploit this to read small amounts of private information from the computer's memory that should not be accessible. This could potentially reveal sensitive fragments of data from other operations running on the same system.

Vendors: [Perl](https://junglewise.ai/threats/vendors/perl).

## Quick answers

**Is CVE-2026-12087 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12087 being exploited in the wild.

**How severe is CVE-2026-12087?** Informational severity, with a CVSS score of 3.7, published 15 June 2026.

**Which products and versions are affected?** Perl Socket < 2.041.

**Is there a fix for CVE-2026-12087?** A patch was published on 2026-03-26: Version 2.041 released to CPAN Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12087 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-12087?** Check whether you run Perl Socket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds heap read exists in Socket.xs within the pack_ip_mreq_source() function. The vulnerability is caused by the reuse of a length variable (`STRLEN len`) that incorrectly validates the source argument using the length of the preceding multiaddr argument. Because both fields are 4 bytes, a valid multiaddr allows a source argument shorter than 4 bytes to pass the length check. When the function performs a fixed-size copy into the 4-byte imr_sourceaddr field, it reads up to 3 bytes beyond the source buffer's end, leaking adjacent heap memory into the returned packed structure. This issue was resolved in version 2.041.

## Affected products

- Perl Socket < 2.041

## Timeline

- 2026-03-26: patched: Version 2.041 released to CPAN
- 2026-06-15: disclosed: CVE-2026-12087 published

## References

- [https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb.patch](https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb.patch)
- [https://metacpan.org/release/PEVANS/Socket-2.041/changes](https://metacpan.org/release/PEVANS/Socket-2.041/changes)