{"id":"CVE-2026-85644","aliases":["DEBIAN-CVE-2026-85644","EUVD-2026-88344","GHSA-ch9g-92vf-wwhv","MGASA-2026-0513","SUSE-SU-2026:24244-1","UBUNTU-CVE-2026-85644","USN-8940-1","openSUSE-SU-2026:11863-1","openSUSE-SU-2026:22101-1"],"status":"published","title":"XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference","description":"XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference.\n\nThe wrapper function XS::Parse::Infix generates for a list-associative infix operator checks whether arguments are array references, but it tests using SvRV() rather than SvROK(). SvRV() reads a union slot that only holds a referent once SvROK(sv) is true, so the guard never validates that it is a reference. For an IV or NV that slot holds the number itself, SvRV() returns the caller's value and SvTYPE() dereferences it at offset 12. This will generally result in a segmentation fault.\n\nAn application that hands the wrapper a list built from decoded input (for example, from JSON) lets whoever supplies a number in that list choose the address that the interpreter dereferences.\n\nAn ordinary string's byte 12 is rarely SVt_PVAV so the guard croaks by luck, but an attacker-crafted string carrying 0x0b there passes, and the buffer is then used as an AV head, with AvARRAY taken from bytes 16-23 and its entries pushed onto the Perl stack as live SVs.\n\nA simple proof-of-concept uses the zip operator:\n\n    use Syntax::Operator::Zip 'zip';\n\n    my @args = ([1], 2);\n    zip(@args);","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00373,"percentile":0.31702,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125","CWE-843"],"published":"2026-09-23T00:00:00Z","modified":"2026-10-21T17:23:12Z","fixes":[{"ecosystem":"Debian:14","package":"libxs-parse-keyword-perl","fixed_in":["0.51-1"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"perl-XS-Parse-Keyword","fixed_in":["0.510.0-1.mga10"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"perl-XS-Parse-Keyword","fixed_in":["0.480.0-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"perl-XS-Parse-Keyword","fixed_in":["0.480.0-160000.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"libxs-parse-keyword-perl","fixed_in":["0.49-1ubuntu1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libxs-parse-keyword-perl","fixed_in":["0.49-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"perl-XS-Parse-Keyword","fixed_in":["0.500.0-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"perl-XS-Parse-Keyword","fixed_in":["0.480.0-160000.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:13","package":"libxs-parse-keyword-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.48-2","0.49-1","0.51-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libxs-parse-keyword-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.51-1"}]}],"versions":["0.48-2","0.49-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"perl-XS-Parse-Keyword","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.510.0-1.mga10"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"perl-XS-Parse-Keyword","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.480.0-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"perl-XS-Parse-Keyword","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.480.0-160000.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libxs-parse-keyword-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.49-1ubuntu1"}]}],"versions":["0.49-1","0.49-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libxs-parse-keyword-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.49-1ubuntu0.1"}]}],"versions":["0.48-2","0.49-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libxs-parse-keyword-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.49-1ubuntu1"}]}],"versions":["0.49-1","0.49-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libxs-parse-keyword-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.49-1ubuntu0.1"}]}],"versions":["0.48-2","0.49-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-XS-Parse-Keyword","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.500.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"perl-XS-Parse-Keyword","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.480.0-160000.3.1"}]}]}],"references":[{"url":"https://metacpan.org/release/PEVANS/XS-Parse-Keyword-0.50/changes","tags":["release-notes","report"]},{"url":"https://metacpan.org/release/PEVANS/XS-Parse-Keyword-0.50/diff/PEVANS/XS-Parse-Keyword-0.49#src/infix.c","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/28/14","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85644"},{"url":"https://github.com/advisories/GHSA-ch9g-92vf-wwhv"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-85644","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0513.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36402","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/09/28/14","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624244-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1283247","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85644","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-85644","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85644","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/43916020/","tags":["report"]},{"url":"https://metacpan.org/release/PEVANS/XS-Parse-Keyword-0.50/diff/PEVANS/XS-Parse-Keyword-0.49/src/infix.c","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8940-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-85644","title":"XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference","description":"XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference.\n\nThe wrapper function XS::Parse::Infix generates for a list-associative infix operator checks whether arguments are array references, but it tests using SvRV() rather than SvROK(). SvRV() reads a union slot that only holds a referent once SvROK(sv) is true, so the guard never validates that it is a reference. For an IV or NV that slot holds the number itself, SvRV() returns the caller's value and SvTYPE() dereferences it at offset 12. This will generally result in a segmentation fault.\n\nAn application that hands the wrapper a list built from decoded input (for example, from JSON) lets whoever supplies a number in that list choose the address that the interpreter dereferences.\n\nAn ordinary string's byte 12 is rarely SVt_PVAV so the guard croaks by luck, but an attacker-crafted string carrying 0x0b there passes, and the buffer is then used as an AV head, with AvARRAY taken from bytes 16-23 and its entries pushed onto the Perl stack as live SVs.\n\nA simple proof-of-concept uses the zip operator:\n\n    use Syntax::Operator::Zip 'zip';\n\n    my @args = ([1], 2);\n    zip(@args);","status":"published","published":"2026-09-28T16:09:02.613Z","modified":"2026-09-30T19:50:14.371Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-843","CWE-125"],"updated_at":"2026-11-02T14:19:52.410665Z"}],"euvd":[{"id":"EUVD-2026-88344","description":"XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference.\n\nThe wrapper function XS::Parse::Infix generates for a list-associative infix operator checks whether arguments are array references, but it tests using SvRV() rather than SvROK(). SvRV() reads a union slot that only holds a referent once SvROK(sv) is true, so the guard never validates that it is a reference. For an IV or NV that slot holds the number itself, SvRV() returns the caller's value and SvTYPE() dereferences it at offset 12. This will generally result in a segmentation fault.\n\nAn application that hands the wrapper a list built from decoded input (for example, from JSON) lets whoever supplies a number in that list choose the address that the interpreter dereferences.\n\nAn ordinary string's byte 12 is rarely SVt_PVAV so the guard croaks by luck, but an attacker-crafted string carrying 0x0b there passes, and the buffer is then used as an AV head, with AvARRAY taken from bytes 16-23 and its entries pushed onto the Perl stack as live SVs.\n\nA simple proof-of-concept uses the zip operator:\n\n    use Syntax::Operator::Zip 'zip';\n\n    my @args = ([1], 2);\n    zip(@args);","status":"published","published":"2026-09-28T16:09:02Z","modified":"2026-09-30T19:50:14Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:47.293232Z"}],"ghsa":[{"id":"GHSA-ch9g-92vf-wwhv","title":"XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference.\n...","description":"XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference.\n\nThe wrapper function XS::Parse::Infix generates for a list-associative infix operator checks whether arguments are array references, but it tests using SvRV() rather than SvROK(). SvRV() reads a union slot that only holds a referent once SvROK(sv) is true, so the guard never validates that it is a reference. For an IV or NV that slot holds the number itself, SvRV() returns the caller's value and SvTYPE() dereferences it at offset 12. This will generally result in a segmentation fault.\n\nAn application that hands the wrapper a list built from decoded input (for example, from JSON) lets whoever supplies a number in that list choose the address that the interpreter dereferences.\n\nAn ordinary string's byte 12 is rarely SVt_PVAV so the guard croaks by luck, but an attacker-crafted string carrying 0x0b there passes, and the buffer is then used as an AV head, with AvARRAY taken from bytes 16-23 and its entries pushed onto the Perl stack as live SVs.\n\nA simple proof-of-concept uses the zip operator:\n\n    use Syntax::Operator::Zip 'zip';\n\n    my @args = ([1], 2);\n    zip(@args);","status":"published","published":"2026-09-28T18:31:25Z","modified":"2026-09-30T21:31:56Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:12:38.770231Z"}],"nvd":[{"id":"CVE-2026-85644","description":"XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference.\n\nThe wrapper function XS::Parse::Infix generates for a list-associative infix operator checks whether arguments are array references, but it tests using SvRV() rather than SvROK(). SvRV() reads a union slot that only holds a referent once SvROK(sv) is true, so the guard never validates that it is a reference. For an IV or NV that slot holds the number itself, SvRV() returns the caller's value and SvTYPE() dereferences it at offset 12. This will generally result in a segmentation fault.\n\nAn application that hands the wrapper a list built from decoded input (for example, from JSON) lets whoever supplies a number in that list choose the address that the interpreter dereferences.\n\nAn ordinary string's byte 12 is rarely SVt_PVAV so the guard croaks by luck, but an attacker-crafted string carrying 0x0b there passes, and the buffer is then used as an AV head, with AvARRAY taken from bytes 16-23 and its entries pushed onto the Perl stack as live SVs.\n\nA simple proof-of-concept uses the zip operator:\n\n    use Syntax::Operator::Zip 'zip';\n\n    my @args = ([1], 2);\n    zip(@args);","status":"published","published":"2026-09-28T17:17:51.127Z","modified":"2026-09-30T20:17:34.993Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-125","CWE-843"],"updated_at":"2026-11-02T14:12:52.081323Z"}],"osv":[{"id":"DEBIAN-CVE-2026-85644","description":"XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference.  The wrapper function XS::Parse::Infix generates for a list-associative infix operator checks whether arguments are array references, but it tests using SvRV() rather than SvROK(). SvRV() reads a union slot that only holds a referent once SvROK(sv) is true, so the guard never validates that it is a reference. For an IV or NV that slot holds the number itself, SvRV() returns the caller's value and SvTYPE() dereferences it at offset 12. This will generally result in a segmentation fault.  An application that hands the wrapper a list built from decoded input (for example, from JSON) lets whoever supplies a number in that list choose the address that the interpreter dereferences.  An ordinary string's byte 12 is rarely SVt_PVAV so the guard croaks by luck, but an attacker-crafted string carrying 0x0b there passes, and the buffer is then used as an AV head, with AvARRAY taken from bytes 16-23 and its entries pushed onto the Perl stack as live SVs.  A simple proof-of-concept uses the zip operator:      use Syntax::Operator::Zip 'zip';      my @args = ([1], 2);     zip(@args);","status":"published","published":"2026-09-28T17:17:51.127Z","modified":"2026-10-04T17:00:12.104580939Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:05.022702Z"},{"id":"UBUNTU-CVE-2026-85644","description":"XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference. The wrapper function XS::Parse::Infix generates for a list-associative infix operator checks whether arguments are array references, but it tests using SvRV() rather than SvROK(). SvRV() reads a union slot that only holds a referent once SvROK(sv) is true, so the guard never validates that it is a reference. For an IV or NV that slot holds the number itself, SvRV() returns the caller's value and SvTYPE() dereferences it at offset 12. This will generally result in a segmentation fault. An application that hands the wrapper a list built from decoded input (for example, from JSON) lets whoever supplies a number in that list choose the address that the interpreter dereferences. An ordinary string's byte 12 is rarely SVt_PVAV so the guard croaks by luck, but an attacker-crafted string carrying 0x0b there passes, and the buffer is then used as an AV head, with AvARRAY taken from bytes 16-23 and its entries pushed onto the Perl stack as live SVs. A simple proof-of-concept uses the zip operator:     use Syntax::Operator::Zip 'zip';     my @args = ([1], 2);     zip(@args);","status":"published","published":"2026-09-28T17:17:00Z","modified":"2026-10-21T04:30:02.767002773Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"MGASA-2026-0513","title":"Updated perl-XS-Parse-Keyword package fixes a security vulnerability","description":"XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number\nas an array reference. (CVE-2026-85644)\n","status":"published","published":"2026-10-17T03:21:49Z","modified":"2026-10-17T03:30:03.343476994Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11863-1","title":"perl-XS-Parse-Keyword-0.500.0-1.1 on GA media","description":"These are all security issues fixed in the perl-XS-Parse-Keyword-0.500.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-23T00:00:00Z","modified":"2026-09-24T18:23:16.166259268Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22101-1","title":"Security update for perl-XS-Parse-Keyword","description":"This update for perl-XS-Parse-Keyword fixes the following issue:\n\n- CVE-2026-85644: number treated as an array reference in `infix.c` (bsc#1283247).\n","status":"published","published":"2026-10-14T14:20:25Z","modified":"2026-10-19T17:23:14.478132524Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:24244-1","title":"Security update for perl-XS-Parse-Keyword","description":"This update for perl-XS-Parse-Keyword fixes the following issue:\n\n- CVE-2026-85644: number treated as an array reference in `infix.c` (bsc#1283247).\n","status":"published","published":"2026-10-14T14:19:13Z","modified":"2026-10-21T17:23:12.050267279Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"USN-8940-1","title":"libxs-parse-keyword-perl vulnerability","description":"It was discovered that the Perl XS::Parse::Keyword module did not\ncorrectly handle certain inputs. If a user or automated system were\ntricked into receiving specially crafted input, an attacker could cause\na denial of service.","status":"published","published":"2026-10-20T03:21:29Z","modified":"2026-10-21T04:41:56.356651818Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}