ExtUtils::Typemaps::STL::String before version 1.06 contains a typemap that constructs a C++ std::string from a Perl scalar by first calling SvPV_nolen to obtain the string data and SvCUR to obtain its length. Because the order of evaluation for C++ function arguments is unspecified, certain compilers may evaluate SvCUR before SvPV_nolen. If the provided scalar is not a string—such as an integer, number, or reference—SvCUR returns an undefined value, and the constructed std::string attempts to copy from an invalid memory range, causing the program to abort or segfault. This unsafe memory read is identified as CWE‑125 and results in a denial of service via application crash.

Any installation that uses ExtUtils::Typemaps::STL::String versions earlier than 1.06 for the Perl T_STD_STRING typemap is affected. The vulnerability also impacts any Perl module that compiles against ExtUtils::Typemaps::Default before version 1.06, because the library includes the flawed typemap implementation. Upgrading to ExtUtils::Typemaps::Default 1.06 or later replaces the incorrect logic and mitigates the issue. Modules that link against the older library must be rebuilt after applying the patch.

The EPSS score is < 1% and the CVSS score is 9.1; the vulnerability is not listed in the CISA KEV catalog, indicating no widespread exploitation has been detected. Based on the description, it is inferred that an attacker would need to supply a non‑string argument to a module that uses the vulnerable typemap; this could be possible if the attacker controls input data passed to such modules. If such an attack vector exists, the exploit would likely cause a crash rather than remote code execution or data exfiltration. The resulting denial of service could be used to disrupt services or as a step in a larger attack chain, but the current risk remains moderate due to the lack of observable exploitation and the need for specific input conditions.