DBI versions prior to 1.650 for Perl contain a heap overflow that occurs when preparsing SQL statements containing an extreme number of placeholders. The flaw arises because the program does not allocate sufficient memory to accommodate approximately 1.2 million placeholders, potentially allowing an attacker to corrupt memory or execute arbitrary code. By exploiting the overflow, an attacker could compromise the integrity of the application or the underlying system if privileges allow.

Vulnerable products are provided by HMBRAND under the DBI module for Perl. Any installation of DBI before version 1.650 is affected. The patch in version 1.650 introduces a hard limit of 99,999 placeholders to prevent the overflow.

EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is not provided, but a heap overflow of this nature typically carries a high impact potential. Exploitation would require an attacker to supply a SQL statement with an extraordinarily large number of placeholders, which may be difficult in practice. Nonetheless, the risk remains significant for applications that accept user-supplied queries with many parameters, especially if such inputs are not validated or limited by the application.