CVE-2026-12087

{
  "id": "CVE-2026-12087",
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "published": "2026-06-15T22:16:16.197",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Socket versions before 2.041 for Perl have an out-of-bounds heap read.\n\nIn Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.\n\nCalling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure."
    },
    {
      "lang": "es",
      "value": "Las versiones de Socket anteriores a la 2.041 para Perl tienen una lectura de montón fuera de límites.\n\nEn Socket.xs, pack_ip_mreq_source() verifica la longitud de su argumento source antes de que se lea el argumento, por lo que la verificación prueba la longitud en bytes arrastrada desde el argumento multiaddr precedente en su lugar. Ambas direcciones ocupan un campo de 4 bytes, por lo que un multiaddr válido permite que un source de cualquier longitud pase la verificación, y el source se copia luego en el campo imr_sourceaddr de 4 bytes con una copia de tamaño fijo. Un source más corto que 4 bytes no es rechazado, y la copia lee hasta 3 bytes más allá del final de su búfer.\n\nLlamar a pack_ip_mreq_source() con un valor source más corto que 4 bytes copia memoria de montón adyacente en la estructura empaquetada devuelta."
    }
  ],
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "vendor": "PEVANS",
          "product": "Socket",
          "defaultStatus": "unaffected",
          "collectionURL": "https://cpan.org/modules",
          "packageName": "Socket",
          "programFiles": [
            "Socket.xs"
          ],
          "programRoutines": [
            {
              "name": "pack_ip_mreq_source"
            }
          ],
          "versions": [
            {
              "version": "0",
              "lessThan": "2.041",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-16T15:43:23.064154Z",
          "id": "CVE-2026-12087",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        },
        {
          "lang": "en",
          "value": "CWE-805"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb.patch",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://metacpan.org/release/PEVANS/Socket-2.041/changes",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/06/15/10",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}