{"id":"CVE-2026-107373","revision":"3ada29f757664b9080d46b1f0ea2f51b","records":[{"revision":"3ada29f757664b9080d46b1f0ea2f51b","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-107373","aliases":[],"title":"ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument","description":"ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument.\n\nThe typemap uses\n\n    $var = std::string( SvPV_nolen($arg), SvCUR($arg) )\n\nHowever, evaluation order for C++ arguments is not specified, and some compilers may produce code that evalutes SvCUR($arg) first.\n\nWhen $arg is not a string (for example, an interger, number or a reference) then SvCUR will return an invalid value, and the program may abort or segfault.","state":0,"publishedAt":"2026-10-10T12:44:08.099+00:00","modifiedAt":"2026-10-16T15:39:45.111+00:00","affected":[{"ecosystem":"https://cpan.org/modules","name":"ExtUtils-Typemaps-Default","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"collectionURL\": \"https://cpan.org/modules\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"modules\": [\n                        \"ExtUtils::Typemaps::STL::String\"\n                    ],\n                    \"packageName\": \"ExtUtils-Typemaps-Default\",\n                    \"packageURL\": \"pkg:cpan/ExtUtils-Typemaps-Default\",\n                    \"programFiles\": [\n                        \"lib/ExtUtils/Typemaps/STL/String.pm\"\n                    ],\n                    \"repo\": \"https://github.com/tsee/extutils-typemap-default\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"1.06\",\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"versionType\": \"custom\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://metacpan.org/release/SMUELLER/ExtUtils-Typemaps-Default-1.06/changes","https://github.com/tsee/extutils-typemap-default/commit/a6b9c298b34ddadc582961403e715d292f82a22d","https://rt.cpan.org/Public/Bug/Display.html?id=94110","https://www.cve.org/CVERecord?id=CVE-2026-80490"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-107373","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-107373","identifiers":["CVE-2026-107373"]},"retained":false,"historicalAffected":[]}],"coverage":[]}