A buffer‑overread of one byte occurs in the DBI preparse routine when it removes an initial SQL comment. On memory‑hardened builds the fault triggers a crash, while on normal builds it leads to nondeterministic newline handling, potentially destabilising affected applications.

All installations of the HMBRAND DBI module for Perl running a version earlier than 1.650 that use preparse with SQL statements starting with a comment line.

The CVSS score of 9.1 signifies a high‑severity flaw, yet the EPSS score of less than 1 % indicates a low probability of exploitation in the wild. The vulnerability does not appear in the CISA KEV catalog. The likely attack vector involves any Perl application that constructs or accepts SQL strings beginning with a comment and passes them to DBI; an attacker could trigger the fault by supplying such a string, resulting in a crash or unpredictable behavior but not direct code execution.