CVE-2026-57074
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
The vulnerability in the XML::Bare library for Perl (versions up to 0.53) is due to unbounded character lookahead in the parserc_parse function. This function does not check that offsets are within the buffer, which can cause an out-of-bounds read with truncated strings like "<a/".
Risk Assessment
The risk involves a potential out-of-bounds read, which could lead to disclosure of sensitive data or application crashes when processing XML data.
Recommendation
It is recommended to immediately update the XML::Bare library to a version newer than 0.53 if available, or apply temporary mitigations such as input validation before processing.
Original NVD description (English source)
XML::Bare versions through 0.53 for Perl have an unbounded character lookahead. The parserc_parse function attempts to check for multicharacter strings such as "<![CDATA" or element terminators such as ">" without checking that the offsets are within the buffer. Truncated strings such as "<a/" can trigger an out-of-bounds read.