Crypt::Sodium::XS up to 0.001000 allows integer overflows in functions such as combined aead encryption, signature creation, and bin2hex. The lack of bounds checking can cause the calculation of output sizes to wrap around, producing undersized buffers. For most algorithms this results in a crash, but for AES-256-GCM encryption and signatures the buffer underflow could lead to a buffer overflow that may corrupt memory or allow control flow hijack.

The vulnerability affects the IAMB Crypt::Sodium::XS Perl module versions 0.000000 through 0.001000. Users deploying these versions of the module in any Perl framework, including web applications, command‑line tools, or services that rely on the module for cryptographic operations, are impacted. The provided CPE indicates the product's presence on Perl.

The CVSS score of 7.5 indicates high severity. EPSS is below 1 %, suggesting that exploitation is unlikely in the wild, and it is not listed in the CISA KEV catalog. Attackers would need to supply unusually large inputs to trigger the overflow, which may be infeasible in many contexts. Nonetheless, if an attacker controls the data passed to these functions, there is a non‑zero risk of memory corruption and potentially code execution.