Storable 3.40 and earlier for Perl contain a signed integer overflow that manifests during deserialization of an SX_HOOK record. The routine retrieve_hook_common reads a signed 32‑bit item count and passes this value to av_extend after adding one. If the count equals I32_MAX, the addition overflows to a negative number, which av_extend cannot handle and causes a fatal panic that terminates the Perl process. The result is a crash that can be triggered by any attacker‑crafted serialized blob, leading to a denial of service for the application performing the deserialization.

All systems that install Storable 3.40 or earlier and use the thaw or retrieve functions to process serialized data are affected. The vulnerability applies to any Perl installation where Storable is available, including web applications, command‑line utilities, and background services that deserialize data from external sources.

The severity of the flaw is reflected in a CVSS score of 9.8. The EPSS score is less than 1 percent, indicating a very low but non‑zero chance of exploitation. The vulnerability is not yet listed in the CISA KEV catalog. Attackers can trigger the overflow by supplying a crafted SX_HOOK record to thaw or retrieve, which could come from a network request, file upload, or any other untrusted input. The impact is limited to the crashing process and does not provide direct confidentiality or integrity compromise.