CVE-2026-107373: Perl ExtUtils::Typemaps::STL Buffer Overflow

CVE-2026-107373 Overview

CVE-2026-107373 affects ExtUtils::Typemaps::STL::String versions before 1.06, a Perl distribution that provides the T_STD_STRING typemap for XS code generation. The typemap constructs a C++ std::string from a Perl scalar using SvPV_nolen($arg) and SvCUR($arg) as arguments. C++ does not specify argument evaluation order, so some compilers evaluate SvCUR($arg) before the scalar is stringified. When the input scalar is an integer, number, or reference rather than a string, SvCUR returns an invalid length that drives an out-of-bounds read [CWE-125], causing the program to abort or segfault.

Critical Impact
Perl XS modules built with the vulnerable typemap can be crashed or forced to read out-of-bounds memory when passed non-string scalar arguments.

Affected Products

ExtUtils::Typemaps::STL::String versions before 1.06
Perl XS modules that incorporate the T_STD_STRING typemap
Perl XS modules that incorporate the T_STD_STRING_PTR typemap

Discovery Timeline

2026-10-10 - CVE-2026-107373 published to the National Vulnerability Database (NVD)
2026-10-16 - Last updated in the NVD database

Technical Details for CVE-2026-107373

Vulnerability Analysis

The T_STD_STRING typemap generates XS code that constructs a C++ std::string from a Perl scalar (SV). The original implementation calls SvPV_nolen($arg) to obtain the character pointer and SvCUR($arg) to obtain the length, passing both to the std::string constructor in a single expression.

The C++ standard does not define the evaluation order of function arguments. Several compilers emit code that evaluates SvCUR($arg) before SvPV_nolen($arg). SvCUR only returns a valid length after the scalar has been stringified; reading it from an integer, floating-point value, or reference yields a length unrelated to any actual string buffer. The std::string constructor then reads that number of bytes starting from the pointer returned by SvPV_nolen, producing an out-of-bounds read.

The out-of-bounds read either terminates the process via SIGSEGV or returns adjacent memory contents to the caller, depending on the surrounding allocation layout.

Root Cause

The root cause is reliance on unspecified C++ argument evaluation order [CWE-125]. The typemap assumes SvPV_nolen runs first and forces stringification before SvCUR is read, but the C++ language does not guarantee that ordering.

Attack Vector

An attacker supplies a non-string Perl scalar (integer, number, or reference) to any XS function whose arguments use the T_STD_STRING or T_STD_STRING_PTR typemap. Reachability depends on whether the hosting application exposes such parameters to untrusted input, including network-facing Perl services that forward user data into XS calls.

text

 std::string   T_STD_STRING
 std::string*  T_STD_STRING_PTR
 
-INPUT
 T_STD_STRING
-    $var = std::string( SvPV_nolen( $arg ), SvCUR( $arg ) );
+      size_t len;
+      const char * c = SvPV($arg, len);
+      $var = std::string(c, len);
 
 T_STD_STRING_PTR
-    $var = new std::string( SvPV_nolen( $arg ), SvCUR( $arg ) );
+      size_t len;
+      const char * c = SvPV($arg, len);
+      $var = new std::string(c, len);
 
 OUTPUT
 T_STD_STRING

Source: GitHub commit a6b9c29. The patch replaces the two-argument stringification pattern with SvPV($arg, len), which stringifies the scalar and returns the length in a single, well-ordered call.

Detection Methods for CVE-2026-107373

Indicators of Compromise

Unexpected SIGSEGV or abort() termination of Perl processes that load XS modules built against ExtUtils::Typemaps::STL::String prior to 1.06.
Core dumps whose crashing frame is inside the std::basic_string constructor called from generated XS wrapper code.
Error log entries showing Perl worker restarts following requests that submit numeric or reference values to parameters that expect strings.

Detection Strategies

Inventory installed CPAN distributions and flag ExtUtils-Typemaps-Default releases below 1.06 on build hosts and production systems.
Grep XS source trees for T_STD_STRING and T_STD_STRING_PTR typemap usage to identify modules that must be rebuilt after upgrading the typemap distribution.
Review input validation in Perl handlers that call affected XS functions and confirm scalars are stringified before being passed in.

Monitoring Recommendations

Alert on repeated crashes or restart loops of Perl-based services, especially under traffic that varies parameter types.
Monitor system logs for segmentation faults attributed to Perl interpreters loading C++ XS extensions.
Track CPAN dependency updates in CI/CD pipelines to ensure new builds pick up patched typemap versions.

How to Mitigate CVE-2026-107373

Immediate Actions Required

Upgrade ExtUtils::Typemaps::STL::String to version 1.06 or later on all build systems.
Rebuild and redeploy every XS module that was previously compiled against a vulnerable typemap; the fix is applied at XS code generation time, not at runtime.
Audit Perl entry points that forward untrusted data into XS functions and enforce string coercion before the call.

Patch Information

The fix is published in ExtUtils-Typemaps-Default 1.06. The typemap now uses SvPV($arg, len) to stringify the scalar and retrieve the length in one call, eliminating the dependency on C++ argument evaluation order. See the MetaCPAN Changes Log, the GitHub commit, and CPAN Bug Report #94110 for full details.

Workarounds

Force stringification in Perl before calling the affected XS function, for example by concatenating with an empty string ($arg . "") or using sprintf("%s", $arg).
Add explicit type checks in Perl wrappers that reject references and coerce numeric scalars to strings prior to invoking XS code.
Pin build pipelines to ExtUtils-Typemaps-Default 1.06 or later and fail builds that resolve an older version.

bash

# Upgrade the affected distribution and rebuild dependent XS modules
cpanm ExtUtils::Typemaps::Default@1.06

# Verify installed version
perl -MExtUtils::Typemaps::STL::String -e \
  'print $ExtUtils::Typemaps::STL::String::VERSION, "\n"'

# Rebuild any XS module that uses T_STD_STRING / T_STD_STRING_PTR
cd /path/to/xs-module && perl Makefile.PL && make clean && make && make test