CVE-2026-88815: DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv
DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sqltypecastsvpv.
When casting to SQLNUMERIC, sqltypecastsvpv passes the string pointer and length of the SV to groknumber without stringifying it first. An integer (IV) or floating-point (NV) value has no valid string pointer, so groknumber reads from an invalid address, triggering a segmentation fault.
This is reachable in Perl using the sqltypecast function:
my $num = 42; DBI::sqltypecast( $num, DBI::SQLNUMERIC, 0 );
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DBI for Perlto a version that resolves this vulnerability.Fixed in 1.654
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using a DBI version before 1.654 are exposed if they call DBI::sql_type_cast with SQL_NUMERIC and pass an integer or floating-point Perl value.
What does an attacker need to trigger the flaw?
The vulnerable code path requires a call to DBI::sql_type_cast targeting SQL_NUMERIC with a numeric IV or NV value. This causes an invalid memory read and can trigger a segmentation fault.
How can I determine whether my application is affected?
Check whether it uses DBI before version 1.654 and whether any code calls DBI::sql_type_cast with DBI::SQL_NUMERIC on numeric values, such as an unstringified integer or floating-point variable.
What should be done if an immediate upgrade is not possible?
Avoid passing integer or floating-point values directly to DBI::sql_type_cast when casting to SQL_NUMERIC. Convert the value to a string before making that call.