Executive brief
The Perl DBI library, a standard database interface for the Perl programming language, contained a flaw in how it handled error messages. When certain error-reporting features were enabled, the library would write error details into a fixed-size memory buffer without checking if the message fit. An attacker who can trigger specific database errors containing long strings could potentially crash the application or gain unauthorized control over the system.
Technical details
A stack-based buffer overflow exists in DBI.xs within the Perl DBI library prior to version 1.648. The vulnerability is caused by the use of `sprintf` to write error metadata (including the implementation stash name and method name) into a fixed 200-byte buffer (`char intro[200]`) without bounds checking. An attacker who can influence the text of error messages—for example, through malicious database driver responses or crafted input that triggers specific error strings—can overflow this buffer. This can lead to memory corruption, application crashes, or potentially arbitrary code execution. The issue was resolved by replacing the fixed buffer and `sprintf` with `newSVpvf`, which dynamically allocates a Perl scalar for the formatted string.
Affected products
- Perl DBI < 1.648
Timeline
- 2025-05-27: patched: Fix committed to DBI repository.
- 2026-06-04: advisory: Release of version 1.648 with security fix.
- 2026-06-09: disclosed: CVE-2026-9698 published.