CVE-2026-12087

{"id": "CVE-2026-12087", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12087", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-16T15:43:23.064154Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"vendor": "PEVANS", "product": "Socket", "versions": [{"status": "affected", "version": "0", "lessThan": "2.041", "versionType": "custom"}], "packageName": "Socket", "programFiles": ["Socket.xs"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "pack_ip_mreq_source"}]}]}], "published": "2026-06-15T22:16:16.197", "references": [{"url": "https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb.patch", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/PEVANS/Socket-2.041/changes", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2026/06/15/10", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-805"}]}], "descriptions": [{"lang": "en", "value": "Socket versions before 2.041 for Perl have an out-of-bounds heap read.\n\nIn Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.\n\nCalling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure."}, {"lang": "es", "value": "Las versiones de Socket anteriores a la 2.041 para Perl tienen una lectura de mont\u00f3n fuera de l\u00edmites.\n\nEn Socket.xs, pack_ip_mreq_source() verifica la longitud de su argumento source antes de que se lea el argumento, por lo que la verificaci\u00f3n prueba la longitud en bytes arrastrada desde el argumento multiaddr precedente en su lugar. Ambas direcciones ocupan un campo de 4 bytes, por lo que un multiaddr v\u00e1lido permite que un source de cualquier longitud pase la verificaci\u00f3n, y el source se copia luego en el campo imr_sourceaddr de 4 bytes con una copia de tama\u00f1o fijo. Un source m\u00e1s corto que 4 bytes no es rechazado, y la copia lee hasta 3 bytes m\u00e1s all\u00e1 del final de su b\u00fafer.\n\nLlamar a pack_ip_mreq_source() con un valor source m\u00e1s corto que 4 bytes copia memoria de mont\u00f3n adyacente en la estructura empaquetada devuelta."}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}