Description
ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument.
The typemap uses
$var = std::string( SvPV_nolen($arg), SvCUR($arg) )
However, evaluation order for C++ arguments is not specified, and some compilers may produce code that evalutes SvCUR($arg) first.
When $arg is not a string (for example, an interger, number or a reference) then SvCUR will return an invalid value, and the program may abort or segfault.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | ExtUtils-Typemaps-Default | < 1.06 | 1.06 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libextutils-typemaps-default-perl | 1.07-1 | — |
| Debian 13 | libextutils-typemaps-default-perl | No fix yet | — |
| Debian 12 | libextutils-typemaps-default-perl | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libextutils-typemaps-default-perl | No fix yet | — |
| Ubuntu 26.04 LTS | libextutils-typemaps-default-perl | No fix yet | — |
| Ubuntu 24.04 LTS | libextutils-typemaps-default-perl | No fix yet | — |
| Ubuntu 22.04 LTS | libextutils-typemaps-default-perl | No fix yet | — |
| Ubuntu 20.04 LTS | libextutils-typemaps-default-perl | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | libextutils-typemaps-default-perl | No fix yet | — |
| Ubuntu 16.04 LTS | libextutils-typemaps-default-perl | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | perl-ExtUtils-Typemaps-Default | 1.70.0-1.1 | openSUSE-SU-2026:12404-1 |
| openSUSE Tumbleweed | perl-Math-Clipper | 1.300.0-1.1 | openSUSE-SU-2026:12490-1 |
Advisories 2
- openSUSE-SU-2026:12490-1 perl-Math-Clipper-1.300.0-1.1 on GA media SUSE / openSUSE Security Updates · Nov 9, 2026
- openSUSE-SU-2026:12404-1 perl-ExtUtils-Typemaps-Default-1.70.0-1.1 on GA media SUSE / openSUSE Security Updates · Nov 4, 2026
References
- https://metacpan.org/release/SMUELLER/ExtUtils-Typemaps-Default-1.06/changes release-notes
- https://github.com/tsee/extutils-typemap-default/commit/a6b9c298b34ddadc582961403e715d292f82a22d
- https://rt.cpan.org/Public/Bug/Display.html?id=94110 issue-tracking
- https://www.cve.org/CVERecord?id=CVE-2026-80490 related