The Net::IP::LPM Perl module, in versions prior to 1.11, performs a heap out-of-bounds read during trie construction when add() is called with a prefix length that exceeds the address width. The prefix string is forwarded to addPrefixToTrie() without validating the length; the helper then walks the packed address buffer bit by bit, reading bytes up to prefix_len/8. For a prefix length over 32 for IPv4 or 128 for IPv6 (for example, add('1.2.3.4/255', …) or add('2001:db8::/255', …)), the read index goes beyond the 4-byte or 16-byte buffer. Since the length is stored in an unsigned char, the over-read is limited to at most 32 bytes beyond the buffer. These out-of-bounds reads are detectable by AddressSanitizer, Valgrind or a hardened allocator and may cause the process to abort, but no user data is returned by the module's API.

Perl applications that import Net::IP::LPM module version 1.10 or earlier are affected. The flaw is triggered by the add() API when it receives a malformed prefix length supplied by external input or another component. The vulnerability is confined to the construction of the routing trie and does not expose data through the module's API.

The CVSS score of 9.1 indicates a high‑severity vulnerability that can be triggered by a simple API call. Although the EPSS score of < 1% suggests a low likelihood of observed exploitation at present, the potential for immediate process termination makes the risk significant for any system that imports the affected module. The breach is not listed in the CISA KEV catalog, indicating no widespread attacks have been reported. The attack vector is inferred to be an application that can influence the call to add(), either locally or remotely, depending on how the Perl code is exposed. Prompt mitigation is therefore advised.