CVE-2026-73193

A flaw was found in DBI. On 32-bit Perl systems, a vulnerability exists in the preparse function due to an integer wraparound when calculating the output buffer size. A remote attacker can exploit this by providing a specially crafted, excessively large statement. This can lead to a heap out-of-bounds write, potentially allowing the attacker to execute arbitrary code or cause a denial of service.

This vulnerability is rated as Important because successful exploitation allows memory corruption and potential arbitrary code execution if an application processes an untrusted, oversized SQL statement. The issue specifically requires a 32-bit Perl environment alongside a statement exceeding hundreds of megabytes in size to trigger the integer overflow. Because standard supported Red Hat Enterprise Linux environments operate on 64-bit architectures, this integer wraparound cannot practically be achieved in typical deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.