# CVE-2026-9698: Perl DBI stack buffer overflow in error handling

Source: https://junglewise.ai/threats/cve-2026-9698-perl-dbi-stack-buffer-overflow-in-error-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-09. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-9698 · Severity: info · CVSS 0 · Published 2026-06-09

The Perl DBI library, a standard database interface for the Perl programming language, contained a flaw in how it handled error messages. When certain error-reporting features were enabled, the library would write error details into a fixed-size memory buffer without checking if the message fit. An attacker who can trigger specific database errors containing long strings could potentially crash the application or gain unauthorized control over the system.

Technologies: [Perl DBI Team DBI](https://junglewise.ai/threats/technologies/dbi). Vendors: [Perl DBI Team](https://junglewise.ai/threats/vendors/perl-dbi-team).

## Quick answers

**Is CVE-2026-9698 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9698 being exploited in the wild.

**How severe is CVE-2026-9698?** Informational severity, with a CVSS score of 0, published 9 June 2026.

**Which products and versions are affected?** Perl DBI Team DBI < 1.648.

**Is there a fix for CVE-2026-9698?** A patch was published on 2025-05-27: Fix committed to DBI repository. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9698 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-9698?** Check whether you run Perl DBI Team DBI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow exists in DBI.xs within the Perl DBI library prior to version 1.648. The vulnerability is caused by the use of `sprintf` to write error metadata (including the implementation stash name and method name) into a fixed 200-byte buffer (`char intro[200]`) without bounds checking. An attacker who can influence the text of error messages—for example, through malicious database driver responses or crafted input that triggers specific error strings—can overflow this buffer. This can lead to memory corruption, application crashes, or potentially arbitrary code execution. The issue was resolved by replacing the fixed buffer and `sprintf` with `newSVpvf`, which dynamically allocates a Perl scalar for the formatted string.

## Affected products

- Perl DBI < 1.648

## Timeline

- 2025-05-27: patched: Fix committed to DBI repository.
- 2026-06-04: advisory: Release of version 1.648 with security fix.
- 2026-06-09: disclosed: CVE-2026-9698 published.

## References

- [https://github.com/perl5-dbi/dbi/commit/bfe5d73c162d2d1f761a639a0aa33aad6a9eb54e.patch](https://github.com/perl5-dbi/dbi/commit/bfe5d73c162d2d1f761a639a0aa33aad6a9eb54e.patch)
- [https://metacpan.org/release/HMBRAND/DBI-1.648/changes](https://metacpan.org/release/HMBRAND/DBI-1.648/changes)

## Related threats

- [Perl DBI memory exhaustion in DBI::ProfileData parser](https://junglewise.ai/threats/cve-2026-60081-perl-dbi-memory-exhaustion-in-dbi-profiledata-parser)
- [Perl DBI code injection in Profile attribute](https://junglewise.ai/threats/cve-2026-14380-perl-dbi-code-injection-in-profile-attribute)
- [Perl DBI heap overflow in preparse SQL statement expansion](https://junglewise.ai/threats/cve-2026-10879-perl-dbi-heap-overflow-in-preparse-sql-statement-expansion)