The flaw manifests during the preparsing of SQL statements when the DBI module expands placeholder characters into numbered binders. The module allocates only three characters per binder, which is insufficient for binders numbered 10 and higher. The resulting buffer overrun allows an attacker to overwrite non‑allocated heap space, potentially corrupting control data and enabling arbitrary code execution or denial of service.

All installations of Perl DBI older than version 1.648 are vulnerable. The issue affects every instance where the preparse method processes an SQL statement that includes more than nine binders. No additional vendor-specific variants are listed beyond the base DBI package.

The flaw is a classic buffer overflow (CWE‑787). Exploitation requires that an attacker can supply a statement with more than nine binders to the preparse routine, which is likely possible in applications that accept user input. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, so there is no public evidence of exploitation yet. However, the nature of the heap overwrite suggests the potential impact is high, and the lack of a defined CVSS score in the record calls for cautious assessment and prompt remediation.