The Net::IP::LPM Perl module passes a user‑supplied prefix string directly to its trie builder without validating that the prefix length is within the bounds of the address width. When add() receives a length greater than 32 for IPv4 or 128 for IPv6, the builder walks past the end of the packed address and performs an out‑of‑bounds read of up to 32 bytes. The data read is not used by any public API, but it can trigger a hard abort in hardened allocators, sanitizers or certain runtime environments, resulting in a denial‑of‑service or process termination. This weakness corresponds to CWE‑125.

Perl applications that import TPODER's Net::IP::LPM module version 1.10 or earlier are affected. The flaw is triggered by the add() API when it receives a malformed prefix length supplied by external input or another component. The vulnerability is confined to the construction of the routing trie and does not expose data through the module’s API.

The CVSS score of 9.1 indicates a high‑severity vulnerability that can be triggered by a simple API call. Although the EPSS score of < 1% suggests a low likelihood of observed exploitation at present, the potential for immediate process termination makes the risk significant for any system that imports the affected module. The breach is not listed in the CISA KEV catalog, indicating no widespread attacks have been reported. The attack vector is inferred to be an application that can influence the call to add(), either locally or remotely, depending on how the Perl code is exposed. Prompt mitigation is therefore advised.