DBI versions earlier than 1.651 for Perl fail to enforce consistency between a statement handle’s declared fields and the data passed to the prepare method. When a statement handle declares no fields while the caller supplies a non‑empty row, the internal row‑buffer helper reads from a negative array index. This results in an out‑of‑bounds memory read that can expose arbitrary contents of the process memory to the caller, potentially revealing sensitive data that resides near the buffer in memory.

All installations of the HMBRAND:DBI Perl module with a version number lower than 1.651 are affected. The vendor has provided an official fix by upgrading to version 1.651 or a later release. Systems remaining on older versions should verify that prepare calls are not supplied with inconsistent metadata and row data, as this is the condition that triggers the vulnerability.

The CVSS score of 9.1 reflects the severity of the information‑disclosure impact, although the EPSS score of less than 1% indicates a low likelihood of exploitation at present. The vulnerability requires an attacker to influence the preparation of a database statement in a way that supplies mismatched metadata and rows; this is likely achievable only by a local or application‑level adversary with control over the database interface. Because the issue involves a read rather than a write, the impact is limited to disclosure of internal process memory, with no evidence of code execution or denial of service.