Date::Manip versions up to 6.99 incorrectly accept Unicode digit characters when parsing year, month, or day fields. The \d regex matches any Unicode decimal digit, causing non‑ASCII digits to be silently truncated by Perl’s numeric conversion. The range checks in Date::Manip::Base::check then succeed because only the leading ASCII portion is examined. As a result, an untrusted date string such as "202\u0664" is parsed as the year 0202, producing a misleading date with no parsing error. When application logic uses the returned date for expiration, retention, or other time‑based controls, this discrepancy can be exploited to bypass limits, keep data past intended deadlines, or otherwise subvert business rules.

The vulnerability affects all versions of SBECK Date::Manip for Perl up to and including 6.99. No further version information is supplied, so any installation using this library in that range is potentially vulnerable.

The EPSS score of <1% indicates a very low probability of exploitation, while the CVSS score of 7.5 demonstrates a high severity impact. This vulnerability is not listed in the CISA KEV catalog. An attacker who can supply an untrusted date string to a Perl application that uses Date::Manip for validation may receive a corrupted date from parsing, which could be used to bypass time‑based controls. The description does not explicitly state the exact attacker capabilities or methods, so the potential for exploitation is inferred from the described behavior rather than directly documented.