CVE-2026-107373: ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument

As cited

Copy frozen at 2026-10-10 16:25 UTC (site build).

vulnerabilities

CVE-2026-107373: ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument

ExtUtils::Typemaps::STL::String versions before 1.06 for Perl contain a vulnerability where the typemap may read the SV (scalar value) length before stringifying the argument, potentially causing incorrect memory access. The vulnerability is tracked as CVE-2026-107373 and affects the ExtUtils-Typemaps-Default distribution.

Why it matters: Perl developers using ExtUtils::Typemaps::STL::String for C type mapping should update to version 1.06 or later to prevent potential memory safety issues in XS modules that use the T_STD_STRING typemap.

Source published

2026-10-10 13:45 UTC

First seen by Cybersecurity Tracker

2026-10-10 14:52 UTC