Crypt::SysRandom::XS versions before 0.010 do not check that the requested byte length is non‑negative. Supplying a negative value causes an integer wraparound, allocating a zero‑byte buffer while a large unsigned value is later used for the actual data request. This results in memory writes beyond the allocated heap space, corrupting adjacent data and typically crashing the application. The impact is a denial of service.

The vulnerability affects the Crypt::SysRandom::XS module distributed by LEONT for Perl. All releases older than version 0.010 are susceptible. Most deployments use hard‑coded length arguments, which reduces the chance of exploitation, but any Perl application that forwards untrusted input to the random_bytes() function is potentially impacted.

The CVSS score is 7.5, qualifying as High severity. The EPSS score is reported as less than 1%, indicating a very low probability of observation, and the flaw is not yet listed in the CISA KEV catalog. The likely attack vector is application‑level, requiring that the user process or a component passing untrusted data to random_bytes() can supply a negative value. Although exploitation is not trivial, a successful trial would lead to a crash.