CVE-2026-78183
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A vulnerability in DBD::Pg version 3.21.0 for Perl: heap out-of-bounds write in quote_float. quote_float() allocates the length of the string + 1, but for special literals (NaN, Inf, +Inf, -Inf, Infinity, +Infinity, -Infinity) it emits the literal surrounded by quotes plus NULL, causing an overflow of 2 bytes. This can be reached by the $dbh->quote method, e.g., $dbh->quote("Infinity", DBI::SQL_NUMERIC). This regression was introduced in 3.21.0 by the quote.c rewrite.
Risk Assessment
An attacker can exploit the vulnerability to cause application crashes or potentially arbitrary code execution, potentially leading to system integrity compromise.
Recommendation
It is recommended to upgrade DBD::Pg to a version newer than 3.21.0 that includes a fix. Also avoid using quote with special literals if possible.
Original NVD description (English source)
DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quote_float. quote_float() allocates the length of the string + 1, which is the size of the bare numeric symbol plus NULL. But for special literals NaN, Inf, +Inf, -Inf, Infinity, +Infinity, -Infinity it emits the literal surrounded by quotes plus NULL, which is length + 3 bytes. Every recognised literal (case-insensitive) overflows by 2 bytes, a single quote and a NULL. This can be reached by the $dbh->quote method, for example $dbh->quote( "Infinity", DBI::SQL_NUMERIC ). This regression was introduced in 3.21.0 by the quote.c rewrite.