DBI versions earlier than 1.650 for Perl contain a heap overflow that occurs during preparsing of SQL statements that include an extreme number of placeholders. The module fails to allocate sufficient memory for the placeholder list, leading to a buffer overflow. An attacker who can supply a SQL statement with many placeholders could corrupt memory or potentially execute arbitrary code, compromising application integrity and, if elevated privileges exist, the underlying operating system.

Vulnerable installations are those running the DBI Perl module under the HMBRAND:DBI product line with a version lower than 1.650. Any Perl application that loads such a version and constructs parameterized queries with a large number of bind variables is potentially impacted. The fix was introduced in version 1.650, which imposes a hard limit of 99,999 placeholders to prevent the overflow.

With a CVSS score of 9.8 the flaw has high severity. The EPSS score of <1% indicates a low probability of real‑world exploitation, and the vulnerability is not listed in CISA KEV. Exploitation requires an attacker to supply a SQL statement containing an extraordinarily large number of placeholders, which is only feasible if the application accepts user‑supplied query templates. The weakness is mapped to CWE-131 and CWE-787. If triggered, the overflow can corrupt heap memory and may enable arbitrary code execution or a denial of service.