{"id":"UBUNTU-CVE-2026-73194","details":"DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse. preparse reserves seven output bytes per input byte, the width of the longest ':p99999' expansion. The ':N' branch parses the number with `atoi(src)` and assigns it to the binder counter with no range check, so a statement containing ':2147483648' leaves the counter negative (-2147483648 with glibc, where atoi wraps). Each following '?' then expands through `sprintf(start, \":p%d\", idx++)` to ':p-2147483648', 14 bytes with the terminating NUL where the buffer budgets 7. The placeholder limit added in 1.650 tests the counter against 99,999, which a negative counter passes. Any caller that preparses an untrusted statement into ':pN' style placeholders gets a heap out-of-bounds write that grows with the number of '?' marks following the poisoned placeholder. The '?' and '%s' return styles compare the parsed number against the expected sequence and error out, and are unaffected.","modified":"2026-08-19T13:34:08.628078520Z","published":"2026-08-15T13:17:00Z","upstream":["CVE-2026-73194"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-73194"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-73194"},{"type":"REPORT","url":"https://lists.security.metacpan.org/cve-announce/msg/42707363/"},{"type":"REPORT","url":"https://github.com/perl5-dbi/dbi/commit/29b72ae7d2a8114a734a55840bf1c45b89207809.patch"},{"type":"REPORT","url":"https://github.com/perl5-dbi/dbi/security/advisories/GHSA-623j-hfpc-mrc4"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-10879"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-14739"}],"affected":[{"package":{"name":"libdbi-perl","ecosystem":"Ubuntu:Pro:14.04:LTS","purl":"pkg:deb/ubuntu/libdbi-perl?arch=source&distro=esm-infra-legacy%2Ftrusty"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.627-1","1.628-1","1.630-1","1.630-1ubuntu0.1~esm1","1.630-1ubuntu0.1~esm4","1.630-1ubuntu0.1~esm5","1.630-1ubuntu0.1~esm6"],"ecosystem_specific":{"binaries":[{"binary_name":"libdbi-perl","binary_version":"1.630-1ubuntu0.1~esm6"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-73194.json"}},{"package":{"name":"libdbi-perl","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/libdbi-perl?arch=source&distro=esm-infra-legacy%2Fxenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.633-1","1.634-1","1.634-1build1","1.634-1ubuntu0.1","1.634-1ubuntu0.2","1.634-1ubuntu0.2+esm1","1.634-1ubuntu0.2+esm2"],"ecosystem_specific":{"binaries":[{"binary_version":"1.634-1ubuntu0.2+esm2","binary_name":"libdbi-perl"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-73194.json"}},{"package":{"name":"libdbi-perl","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/libdbi-perl?arch=source&distro=esm-infra%2Fbionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.637-1","1.639-1","1.640-1","1.640-1ubuntu0.1","1.640-1ubuntu0.2","1.640-1ubuntu0.3","1.640-1ubuntu0.3+esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"libdbi-perl","binary_version":"1.640-1ubuntu0.3+esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-73194.json"}},{"package":{"name":"libdbi-perl","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/libdbi-perl?arch=source&distro=esm-infra%2Ffocal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.642-1","1.642-1build1","1.643-1","1.643-1ubuntu0.1","1.643-1ubuntu0.1+esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"libdbi-perl","binary_version":"1.643-1ubuntu0.1+esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-73194.json"}},{"package":{"name":"libdbi-perl","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/libdbi-perl?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.643-3build2","1.643-3build3","1.643-3ubuntu0.1"],"ecosystem_specific":{"binaries":[{"binary_name":"libdbi-perl","binary_version":"1.643-3ubuntu0.1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-73194.json"}},{"package":{"name":"libdbi-perl","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/libdbi-perl?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.643-4","1.643-4build1","1.643-4build2","1.643-4build3","1.643-4ubuntu0.1"],"ecosystem_specific":{"binaries":[{"binary_name":"libdbi-perl","binary_version":"1.643-4ubuntu0.1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-73194.json"}},{"package":{"name":"libdbi-perl","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/libdbi-perl?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.647-1","1.647-1build1","1.647-1ubuntu0.26.04.1"],"ecosystem_specific":{"binaries":[{"binary_name":"libdbi-perl","binary_version":"1.647-1ubuntu0.26.04.1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-73194.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},{"type":"Ubuntu","score":"medium"}]}