The Storable module in Perl suffered a vulnerability that triggers a stack overflow in versions prior to 3.05. The retrieve_hook routine stores the class name length as a signed integer but later interprets it as unsigned during read operations, allowing an attacker to engineer data that overflows the stack. This corruption can lead to the replacement of execution pointers or other critical data, potentially enabling arbitrary code execution within the context of the affected Perl process.

Affected products include the Perl Storable module distributed by the NWCLARK:Storable vendor. Any installation of Storable 3.04 or earlier is vulnerable. The concern applies to all systems running Perl applications that import or deserialize Storable data from untrusted sources.

The CVSS score is 10, indicating critical severity. The EPSS score is unavailable, so the likelihood of exploitation is uncertain, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require the attacker to supply crafted Storable data to a vulnerable Perl program, which may be possible through local file uploads or remote input depending on the application’s design. Based on the description, the likely attack vector is through deserialization of maliciously constructed data.