CVE-2026-107373: ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument
ExtUtils::Typemaps::STL::String versions before 1.06 for Perl TSTDSTRING typemap may read the SV length before stringifying the argument.
The typemap uses
$var = std::string( SvPVnolen($arg), SvCUR($arg) )
However, evaluation order for C++ arguments is not specified, and some compilers may produce code that evalutes SvCUR($arg) first.
When $arg is not a string (for example, an interger, number or a reference) then SvCUR will return an invalid value, and the program may abort or segfault.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ExtUtils::Typemaps::Defaultto a version that resolves this vulnerability.Fixed in 1.06 - Operational
Rebuild any modules that use ExtUtils::Typemaps::Default as part of their build process.
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications are exposed if they use the T_STD_STRING typemap from ExtUtils::Typemaps::STL::String before version 1.06 and pass a non-string Perl value, such as an integer, number, or reference, to the mapped argument.
What does an attacker need to trigger the failure?
The attacker or other input source would need to cause a non-string value to reach a C++ binding argument that uses the affected T_STD_STRING typemap. On compilers that evaluate SvCUR before stringification, this can yield an invalid length and cause an abort or segmentation fault.
What is the available remediation?
Upgrade ExtUtils::Typemaps::STL::String to version 1.06 or later. The issue affects versions before 1.06.