ExtUtils::Typemaps::STL::Vector modules prior to version 1.05 allocate an enormous 32 GiB array when processing an empty list. The typemap triggers av_extend with a length that expands to 2^32 slots, causing the Perl interpreter to attempt this allocation and exhaust memory, which in turn crashes or hangs the running process. The underlying weakness is an integer overflow handling flaw (CWE-191).

The flaw exists in ExtUtils::Typemaps::STL::Vector for Perl, in versions before 1.05. Perl installations that load this module are vulnerable, and any Perl application or module that depends on it may also be affected. The issue is resolved in ExtUtils::Typemaps::Default 1.07 or later; modules that use the typemap must be rebuilt after upgrading to avoid reintroducing the defect.

The vulnerability can be triggered by any input that causes the typemap to process an empty list. Because the module performs a massive allocation, a local user who can run or influence a Perl program that uses the typemap can cause a denial‑of‑service. The EPSS score is less than 1%, indicating a very low probability of exploitation, and the entry is not listed in CISA’s KEV catalog. The CVSS score of 7.5 reflects a high severity of availability impact. Although the attack vector is inferred from the description, it likely requires the ability to supply data to the affected program, which could be local or remote if the program exposes a network interface.