The XML::Bare library for Perl scans input buffers for markers such as "<![CDATA" or element terminators like ">" without first verifying that the calculated offsets remain within the provided data. When it encounters a truncated sequence, for example "<a/", the routine attempts to read beyond the end of the buffer. This unbounded read is a classic memory‑safety flaw identified as CWE‑125 and may expose sensitive memory contents or cause a program crash, but it does not provide a direct path to arbitrary code execution.

The flaw affects the CODECHILD XML::Bare Perl module for versions 0.53 and earlier. Any Perl application that imports XML::Bare in one of those releases and parses XML documents—particularly those that accept user‑supplied XML—directly receives the impact.

The CVSS score of 9.1 classifies this vulnerability as critical, indicating a high potential impact if it remains unpatched. The EPSS score is below 1% and the vulnerability is not listed in CISA KEV, suggesting limited publicly known exploitation activity at present. Based on the description, it is inferred that an attacker could trigger the out‑of‑bounds read by supplying crafted XML input to an application that uses XML::Bare. This could be done remotely if the application accepts XML over the network, or locally if an attacker can control the XML payload. The primary consequence is potential leakage of internal state or a denial‑of‑service through a crash, but no elevated privileges or remote code execution are provided.