Net::IDN::Punycode for Perl contains a heap buffer overflow in the XS backend’s encode_punycode function. The implementation sizes an output buffer based on the input length but omits bounds checks for the final digit and the terminating NUL. This allows an attacker‑supplied string to overflow the buffer and corrupt heap memory, which can lead to arbitrary code execution.

The flaw affects all Net::IDN::Punycode versions released before 2.301. Only the XS backend is vulnerable; the pure‑Perl implementation is unaffected. Any system that uses the XS backend to process internationalized domain names is at risk.

An attacker who can supply a crafted IDN label to the encode_punycode function can trigger the overflow and corrupt the heap, potentially allowing arbitrary code execution. The CVSS base score of 9.8 indicates a critical severity and the EPSS score of < 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA KEV, and no public exploits are reported.