A critical heap out-of-bounds write vulnerability in the DBD::Pg Perl module allows unauthenticated remote attackers to potentially achieve arbitrary code execution.

The vulnerability exists due to an incorrect memory allocation size in the quote_float function when handling specific numeric literals like Infinity or NaN. An unauthenticated attacker can trigger this memory corruption by passing crafted input to the quote method of the database handle.

This vulnerability is rated as critical with a CVSS score of 9.8, reflecting the ability for an unauthenticated remote attacker to compromise system integrity and availability. Successful exploitation could lead to arbitrary code execution, resulting in full system compromise, loss of sensitive database information, and significant operational downtime.

Immediate Action: Update the DBD::Pg Perl module to version 3.21.1 or later immediately to resolve the memory allocation defect.

Proactive Monitoring: Monitor database and application logs for unusual crashes or unexpected input patterns related to database quoting functions.

Compensating Controls: While no direct virtual patch exists, ensure that database interactions are strictly validated to prevent malformed numeric literals from reaching the database driver.

Public Exploit Available: No (exploit_available unknown).

The severity of this vulnerability, combined with the ease of remote reachability, necessitates an immediate update to the patched version. Organizations utilizing the DBD::Pg module in Perl-based database applications should prioritize this deployment to prevent potential remote code execution and data breaches.