ExtUtils::Typemaps::STL::List, used in Perl, has a flaw that causes it to allocate a 32 GiB array when invoked on an empty list. The underlying bug stems from a buffer underflow: the code calls av_extend(av, len-1 and for an empty list, len is zero, so len-1 underflows to an extremely large number. This overlarge allocation can exhaust system memory, potentially crashing the Perl interpreter or any process building or loading the module. The weakness is an integer underflow/overflow, classified as CWE-191.

The vulnerability affects ExtUtils::Typemaps::STL::List versions earlier than 1.07 intended for the Perl environment. It can impact any Perl application or module that includes this typemap during compilation or runtime. The referenced bug was similarly addressed in ExtUtils::Typemaps::STL::Vector 1.05, but the list typemap remains vulnerable until its 1.07 patch.

The CVSS score is 7.5. Memory exhaustion is a high‑impact denial of service. The EPSS score is 0.00185, indicating a very low probability of exploitation, and the vulnerability is not currently listed in CISA KEV. The likely attack vector involves an attacker having the ability to install or compile Perl modules that depend on the vulnerable typemap. This could occur locally on a system where the user runs a Perl script or builds a module, or remotely if a web application relies on the typemap during request processing. An attacker could trigger the bug by constructing or loading an empty list, thus exhausting memory.