The flaw manifests during the preparsing of SQL statements when the DBI module expands placeholder characters into numbered binders. The module allocates only three characters per binder, which is insufficient for binders numbered 10 and higher. The resulting buffer overrun allows an attacker to overwrite non‑allocated heap space, potentially corrupting control data and enabling arbitrary code execution or denial of service.

All installations of Perl DBI older than version 1.648 are vulnerable. The issue affects every instance where the preparse method processes an SQL statement that includes more than nine binders. No additional vendor-specific variants are listed beyond the base DBI package.

The flaw is a classic buffer overflow (CWE‑787). Exploitation requires that an attacker can supply a statement with more than nine binders to the preparse routine, which is likely possible in applications that accept user input. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, so there is no public evidence of exploitation yet. The CVSS score of 9.8 indicates a high severity, and the heap overwrite suggests potential impact is high, warranting prompt remediation.