{"schema":"threatline.record/2","record":{"id":"CVE-2026-85644","aliases":[],"summary":"XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference","details":"XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference.\n\nThe wrapper function XS::Parse::Infix generates for a list-associative infix operator checks whether arguments are array references, but it tests using SvRV() rather than SvROK(). SvRV() reads a union slot that only holds a referent once SvROK(sv) is true, so the guard never validates that it is a reference. For an IV or NV that slot holds the number itself, SvRV() returns the caller's value and SvTYPE() dereferences it at offset 12. This will generally result in a segmentation fault.\n\nAn application that hands the wrapper a list built from decoded input (for example, from JSON) lets whoever supplies a number in that list choose the address that the interpreter dereferences.\n\nAn ordinary string's byte 12 is rarely SVt_PVAV so the guard croaks by luck, but an attacker-crafted string carrying 0x0b there passes, and the buffer is then used as an AV head, with AvARRAY taken from bytes 16-23 and its entries pushed onto the Perl stack as live SVs.\n\nA simple proof-of-concept uses the zip operator:\n\n    use Syntax::Operator::Zip 'zip';\n\n    my @args = ([1], 2);\n    zip(@args);","categories":["Unclassified"],"product":"","vendor":"","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-85644","source_modified_at":"2026-09-30T19:50:14.371Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":null,"vendor":null,"versions":[{"lessThanOrEqual":"0.49","status":"affected","version":"0.40","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":7.5,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00393,"percentile":0.32322,"score_date":"2026-10-23"},"published_at":"2026-09-28T16:09:02.613Z","modified_at":"2026-09-30T19:50:14.371Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-85644","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-09-30T19:50:14.371Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85644","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://metacpan.org/release/PEVANS/XS-Parse-Keyword-0.50/changes","tags":["release-notes"]},{"source":"CVE List","url":"https://metacpan.org/release/PEVANS/XS-Parse-Keyword-0.50/diff/PEVANS/XS-Parse-Keyword-0.49#src/infix.c"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CISA ADP","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-09-30T19:50:11.084770Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-30T19:50:14.371Z","content_hash":"43d63151160b5d69f07c468b0acb32f43c7c2f3e23698e88be16209f50ff676f"}}