{"id":"CVE-2026-85644","revision":"e8c5e4c75a3a4c73bed8b50158cb14b2","records":[{"revision":"e8c5e4c75a3a4c73bed8b50158cb14b2","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-85644","aliases":[],"title":"XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference","description":"XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference.\n\nThe wrapper function XS::Parse::Infix generates for a list-associative infix operator checks whether arguments are array references, but it tests using SvRV() rather than SvROK(). SvRV() reads a union slot that only holds a referent once SvROK(sv) is true, so the guard never validates that it is a reference. For an IV or NV that slot holds the number itself, SvRV() returns the caller's value and SvTYPE() dereferences it at offset 12. This will generally result in a segmentation fault.\n\nAn application that hands the wrapper a list built from decoded input (for example, from JSON) lets whoever supplies a number in that list choose the address that the interpreter dereferences.\n\nAn ordinary string's byte 12 is rarely SVt_PVAV so the guard croaks by luck, but an attacker-crafted string carrying 0x0b there passes, and the buffer is then used as an AV head, with AvARRAY taken from bytes 16-23 and its entries pushed onto the Perl stack as live SVs.\n\nA simple proof-of-concept uses the zip operator:\n\n    use Syntax::Operator::Zip 'zip';\n\n    my @args = ([1], 2);\n    zip(@args);","state":0,"publishedAt":"2026-09-28T16:09:02.613+00:00","modifiedAt":"2026-09-30T19:50:14.371+00:00","affected":[{"ecosystem":"https://cpan.org/modules","name":"XS-Parse-Keyword","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"collectionURL\": \"https://cpan.org/modules\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"modules\": [\n                        \"XS::Parse::Infix\"\n                    ],\n                    \"packageName\": \"XS-Parse-Keyword\",\n                    \"packageURL\": \"pkg:cpan/XS-Parse-Keyword\",\n                    \"programFiles\": [\n                        \"src/infix.c\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"pp_push_defav_with_count\"\n                        }\n                    ],\n                    \"versions\": [\n                        {\n                            \"lessThanOrEqual\": \"0.49\",\n                            \"status\": \"affected\",\n                            \"version\": \"0.40\",\n                            \"versionType\": \"custom\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://metacpan.org/release/PEVANS/XS-Parse-Keyword-0.50/changes","https://metacpan.org/release/PEVANS/XS-Parse-Keyword-0.50/diff/PEVANS/XS-Parse-Keyword-0.49#src/infix.c"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-85644","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-85644","identifiers":["CVE-2026-85644"]},"retained":false,"historicalAffected":[]}],"coverage":[]}