CVE-2026-12087 PEVANS CVE debrief

Who should care

Developers and administrators using Perl's Socket module versions before 2.041 should be aware of this vulnerability. Successful exploitation could lead to information disclosure or potentially other impacts depending on the specific application and context.

Technical summary

The `pack_ip_mreq_source()` function in Socket.xs incorrectly checks the length of its source argument. It verifies the length after reading the argument, which allows sources of any length to pass the check if preceded by a valid multiaddr. This leads to a fixed-size copy into a 4-byte field, causing an out-of-bounds read for sources shorter than 4 bytes.

Defensive priority

High

Recommended defensive actions

• Update to Socket version 2.041 or later.
• Review and patch vulnerable applications using the provided patches [ref-4].
• Check for updates and advisories from the Perl project and relevant distributions [ref-5].

Evidence notes

Evidence from the NVD and CVE records indicate a high severity issue with significant potential impact. The vulnerability has been publicly disclosed and discussed on security mailing lists [ref-6].

Official resources