The vulnerability originates in Crypt::NaCl::Sodium version 2.002 where functions bin2hex, encrypt, aes256gcm_encrypt_afternm and seal do not enforce that the output buffer size remains below the maximum representable value SIZE_MAX. As a result, when the input message length exceeds a very large threshold, the internal integer calculation wraps around, producing an undersized output buffer. This size mismatch can corrupt memory, potentially allowing an attacker to trigger a buffer overflow and execute arbitrary code. The weakness is classified as CWE‑190: Integer Overflow.

PERL modules from TIMLEGGE:Crypt::NaCl::Sodium through version 2.002 are affected. This includes all distributions using Crypt::NaCl::Sodium 2.002 or earlier. Versions 2.003 and later contain the fix and are not vulnerable.

With a CVSS score of 9.8 the severity is high, but the EPSS score of less than 1 % indicates that widespread exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog. Attacking requires creating a message whose length approaches the size limits of SIZE_MAX, which is impractical under normal circumstances. However, if an attacker can supply such an extreme payload, the potential for remote code execution exists. The importance of the issue remains high due to the severity rating.