CryptX components before version 0.088_001 for Perl contain a stack buffer overflow in four AEAD decrypt_verify helper routines. The routines copy an authentication tag supplied by the caller into a 144‑byte stack buffer without validating the tag’s length, allowing an attacker who can supply a longer tag to overwrite adjacent stack data. This overflow can lead to corruption of the stack frame and potentially arbitrary code execution within the process, compromising confidentiality, integrity, and availability of the affected application.

The vulnerability exists in all CryptX releases prior to 0.088_001, distributed by MIK under the CryptX product line for Perl. Users of the affected Perl bindings—whether through CPAN or other distribution channels—are impacted unless they have upgraded to the fixed version.

The CVSS score of 7.5 and EPSS score of less than 1% indicate a moderate–high severity, but the presence of a stack-based buffer overflow classifies the risk as high. The exploitation requires an attacker to supply a crafted authentication tag; thus the vulnerability is exploitable in any context where the decryption helpers are invoked with attacker-controlled input. No entry in the CISA KEV list further indicates widespread exploitation is not yet documented, yet the absence of mitigation makes it prudent to consider the risk significant.