CVE-2026-85644: XS::Parse::Infix Buffer Overflow Vulnerability

CVE-2026-85644 Overview

CVE-2026-85644 affects XS::Parse::Infix versions 0.40 through 0.49 for Perl. The wrapper function generated for list-associative infix operators treats a numeric scalar as an array reference. The guard uses SvRV() instead of SvROK(), so it never validates that the argument is actually a reference. When an attacker-controlled number or crafted string appears in the argument list, the Perl interpreter dereferences an arbitrary address as an AV structure. The result is typically a segmentation fault, but a carefully crafted byte value at offset 12 can bypass the type check entirely.

Critical Impact
Applications that pass decoded input (for example, JSON-parsed lists) to a list-associative infix operator allow remote attackers to trigger crashes or force the interpreter to treat attacker-supplied bytes as live scalar values.

Affected Products

XS::Parse::Infix version 0.40
XS::Parse::Infix versions 0.41 through 0.48
XS::Parse::Infix version 0.49

Discovery Timeline

2026-09-28 - CVE CVE-2026-85644 published to NVD
2026-09-28 - Public disclosure via OpenWall OSS-Security Post
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-85644

Vulnerability Analysis

The flaw is a type confusion issue classified as [CWE-125] Out-of-Bounds Read. XS::Parse::Infix generates C wrapper code for list-associative infix operators. That wrapper must confirm each argument is an array reference before extracting the underlying AV. Instead of calling SvROK(sv) to check the reference flag, the generated code calls SvRV(sv) directly. SvRV() reads the union slot that only contains a valid referent when SvROK() is true. For an integer (IV) or floating-point (NV) scalar, that slot holds the number itself. The wrapper then calls SvTYPE() on the returned pointer, dereferencing the caller-supplied value as a memory address.

Root Cause

The root cause is a missing reference validation check in the generated wrapper in src/infix.c. SvRV() is a low-level accessor that assumes its argument is already known to be a reference. Without a preceding SvROK() guard, the wrapper reads whatever bit pattern occupies the union slot and treats it as an SV*. The interpreter then reads the type byte at offset 12 to decide whether the target is an array. An ordinary numeric value points to arbitrary process memory.

Attack Vector

An application that hands a list-associative operator such as zip a list built from decoded input allows the input supplier to control the dereferenced address. A number in the list becomes a pointer. A crafted string whose byte at offset 12 equals 0x0b (matching SVt_PVAV) passes the type check, and bytes 16 through 23 are read as the AvARRAY pointer. Entries at that address are pushed onto the Perl stack as live SV* values, extending the primitive from a crash to arbitrary read of interpreter memory.

A minimal proof of concept using Syntax::Operator::Zip passes a two-element list where the second element is the integer 2. The wrapper dereferences the value 2 as a scalar pointer, producing a segmentation fault. See the MetaCPAN Release Diff for the corrected reference check.

Detection Methods for CVE-2026-85644

Indicators of Compromise

Unexpected SIGSEGV crashes in Perl processes that load XS::Parse::Keyword or Syntax::Operator::Zip.
Core dumps whose faulting instruction is inside a wrapper generated by XS::Parse::Infix and dereferences a low or non-canonical address.
Application logs showing operator invocations immediately preceding interpreter termination when input originates from untrusted JSON or form data.

Detection Strategies

Inventory installed Perl modules and flag any XS::Parse::Keyword distribution earlier than 0.50.
Audit application source for list-associative infix operators such as zip that receive lists derived from network input.
Enable core-dump collection on Perl services and forward crash telemetry to a centralized log store for correlation.

Monitoring Recommendations

Alert on repeated Perl worker crashes across web front-ends handling deserialized input.
Ingest process crash events and web server 5xx spikes into a SIEM and correlate against XS::Parse::Infix module versions.
Track CPAN dependency drift so downstream modules pulling in vulnerable versions are surfaced during builds.

How to Mitigate CVE-2026-85644

Immediate Actions Required

Upgrade XS::Parse::Keyword to version 0.50 or later on all systems running Perl services.
Rebuild and redeploy any XS modules that link against or generate code through XS::Parse::Infix.
Review application code that passes user-controlled lists to list-associative operators and add explicit reference validation.

Patch Information

The upstream fix ships in XS::Parse::Keyword0.50. The corrected wrapper replaces the direct SvRV() call with an SvROK() guard before extracting the array reference. See the MetaCPAN Release Changes entry for the release notes and the MetaCPAN Release Diff for the source change in src/infix.c.

Workarounds

Validate every element of an argument list with ref() before invoking a list-associative operator when patching is not immediately possible.
Reject or coerce non-reference elements at the application boundary when decoding JSON or other structured input into operator arguments.
Restrict use of Syntax::Operator::Zip and similar operators to trusted internal call sites until the upgraded module is deployed.

bash

# Upgrade the vulnerable distribution using cpanm
cpanm XS::Parse::Keyword@0.50

# Verify the installed version
perl -MXS::Parse::Keyword -e 'print $XS::Parse::Keyword::VERSION, "\n"'