A critical heap overflow vulnerability in Perl DBI versions before 1.650 permits remote code execution or system instability through specially crafted SQL queries.

The vulnerability is a heap overflow caused by insufficient memory allocation when preparsing SQL statements containing a large volume of placeholders. This issue persists as a result of an incomplete fix for CVE-2026-10879 and allows an unauthenticated attacker to cause memory corruption.

This flaw carries a CVSS score of 9.8, reflecting its potential for total system compromise, including remote code execution and denial-of-service. Successful exploitation could lead to full database control, unauthorized data access, or complete service disruption, posing a severe threat to business continuity and data security.

Immediate Action: Upgrade to DBI version 1.650 or later immediately to implement the hard limit on placeholders and resolve the memory allocation defect.

Proactive Monitoring: Monitor database query performance and application logs for unusual SQL patterns or crashes that may indicate exploitation attempts.

Compensating Controls: Implement input validation at the application level to sanitize SQL queries and limit the number of placeholders allowed in dynamic SQL generation.

Public Exploit Available: false

Given the critical nature of this heap overflow, all systems utilizing the Perl DBI module must be upgraded to version 1.650 or higher. Immediate patching is necessary to mitigate the risk of remote exploitation and ensure the integrity of your database environment.