UnQLite for Perl embeds the UnQLite database engine. Versions up to and including 0.06 contain an older UnQLite library dated 2014 that was identified as having a heap-based buffer overflow. If an attacker can supply crafted input to the Perl module, the overflow could corrupt memory and potentially allow arbitrary code execution or denial of service. This weakness is categorized as CWE-1395.

The vulnerability affects the TOKUHIROM UnQLite Perl distribution. Clients using UnQLite for Perl version 0.06 or earlier are exposed. No specific patch version is available for those releases; the module has been deprecated since 0.06 and newer releases (0.07+) embed a fixed library.

The CVSS score of 9.8 indicates critical severity, but the EPSS score shows a very low probability of exploitation (<1%). The issue is not currently listed in the CISA KEV catalog. Attackers would need to interact with a Perl application that loads the vulnerable module, but the potential for remote exploitation cannot be ruled out if the application processes untrusted data.