List::SomeUtils::XS versions prior to 0.59 contain a heap buffer overflow in the pairwise function. The function preallocates a heap buffer sized to the longer input array and then enlarges it with a single quadrupling operation rather than a loop. When a block executed for a single pair returns more than four times the longest input array, the buffer grows too small and subsequent memcpy writes past its end, corrupting heap memory. This can lead to denial of service or, if an attacker controls the block, arbitrary code execution.

Any Perl installation that loads List::SomeUtils::XS before version 0.59 and uses the pairwise function is impacted. Systems must check the module version in their environment; older releases such as 0.58 and earlier are vulnerable.

No CVSS score is provided in the data, and the EPSS score is not available; the vulnerability is not listed in CISA KEV. The overflow requires the pairwise function to be invoked with a block that can return a large value, implying a local code execution scenario. While public exploits are not reported, the possibility of arbitrary code execution makes it a moderate to high risk for environments where untrusted code can call pairwise.