CVE catalog

CVE-2026-107373

libextutils-typemaps-default-perl: CVE-2026-107373

[CVE catalog]

Severity
Critical · CVSS 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.39% · Oct 25, 2026

ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument. The typemap uses $var = std::string( SvPV_nolen($arg), SvCUR($arg) ) However, evaluation order for C++ arguments is not specified, and some compilers may produce code that evalutes SvCUR($arg) first. When $arg is not a string (for example, an interger, number or a reference) then SvCUR will return an invalid value, and the program may abort or segfault.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibextutils-typemaps-default-perlsid1.07-1fixed
Debianlibextutils-typemaps-default-perlforky1.07-1fixed
Debianlibextutils-typemaps-default-perltrixie1.05-5vulnerable
Debianlibextutils-typemaps-default-perlbookworm1.05-5vulnerable
Ubuntulibextutils-typemaps-default-perl16.041.05-2vulnerable
Ubuntulibextutils-typemaps-default-perl18.041.05-2vulnerable
Ubuntulibextutils-typemaps-default-perl20.041.05-2vulnerable
Ubuntulibextutils-typemaps-default-perl22.041.05-2.1vulnerable
Ubuntulibextutils-typemaps-default-perl24.041.05-5vulnerable
Ubuntulibextutils-typemaps-default-perl26.101.05-5vulnerable
Ubuntulibextutils-typemaps-default-perl26.041.05-5vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibextutils-typemaps-default-perlsourcesid1.07-1not yet assignedNot reported[1150541]
Debianlibextutils-typemaps-default-perlsourceforky1.07-1not yet assignedNot reported[1150541]
Debianlibextutils-typemaps-default-perlsourcetrixie(unfixed)not yet assignedNot reported[1150541]
Debianlibextutils-typemaps-default-perlsourcebookworm(unfixed)not yet assignedNot reported[1150541]

[Debian bug #1150541]

Notes

[trixie] libextutils-typemaps-default-perl: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libextutils-typemaps-default-perl]Affected
    Details (2)

    • 1.05-5 · all · bookworm

      Affected

      dsa · libextutils-typemaps-default-perl · debian · bookworm; dsa · libextutils-typemaps-default-perl · debian · 12

    • 1.05-5 · all · bookworm

      Affected

      dsa · libextutils-typemaps-default-perl · debian · bookworm; dsa · libextutils-typemaps-default-perl · debian · 12

[Debian 13 (Trixie)]

  • [libextutils-typemaps-default-perl]Affected
    Details (2)

    • 1.05-5 · all · trixie

      Affected

      dsa · libextutils-typemaps-default-perl · debian · 13

    • 1.05-5 · all · trixie

      Affected

      dsa · libextutils-typemaps-default-perl · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]