CVE-2026-12844 Details
Description
List::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in the pairwise function. pairwise() collects the values returned by the block into a heap buffer sized to the longer input array, then grows the buffer before each copy with a single quadrupling (alloc <<= 2) instead of a loop. A block call that returns more than four times the current allocation in one invocation outgrows that one quadrupling, and the copy writes past the end of the buffer. Any caller of pairwise() whose block returns, for a single pair, more than four times the longer input array's length writes past the buffer and corrupts the heap.
A heap buffer overflow vulnerability has been identified in List::SomeUtils::XS versions prior to 0.59 for Perl. The issue arises in the pairwise function, where the buffer allocated for collecting values returned by the block is sized according to the longer input array. The buffer is then expanded before each copy by quadrupling the allocation. This approach creates a vulnerability when a block call returns more than four times the length of the longer input array in a single invocation, causing the buffer to overflow and corrupt the heap.
Users can upgrade to List::SomeUtils::XS version 0.59 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 25, 2026CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/houseabsolute/List-SomeUtils-XS/commit/22549f78669b780d6aa338a2d2e49a3dedfffaa6.patch | CPANSec | Source CodeVendor |
| https://metacpan.org/release/DROLSKY/List-SomeUtils-XS-0.59/changes | CPANSec | Release NotesVendor |
| http://www.openwall.com/lists/oss-security/2026/06/25/11 | CVE |
Weakness Enumeration
Affected Products
| Product | Versions |
|---|---|
| List::SomeUtils::XS | < 0.59 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | CVE Modified | CVE |
| Jun 25, 2026 | New CVE Received | CPANSec |