DBI versions prior to 1.652 on 32‑bit Perl compute the preparse output buffer size with a 32‑bit integer, allowing a wraparound on a statement of 613,566,757 bytes. This results in a buffer allocated only 19 bytes in size yet a 585 MB string is copied into it, overwriting heap memory with attacker controlled data. The vulnerability arises from an integer overflow (CWE‑190) followed by an out‑of‑bounds write (CWE‑787). If an attacker can supply such a large statement to preparse, the overflow can corrupt heap structures or inject malicious payloads, leading to loss of integrity or arbitrary code execution.

The flaw affects Perl DBI module versions earlier than 1.652 running on 32‑bit Perl interpreters. Operations that accept untrusted SQL statements on such builds are vulnerable; 64‑bit Perl builds are not impacted because the 32‑bit STRLEN wraparound does not occur.

The flaw is limited to 32‑bit Perl builds; 64‑bit builds would require an impractically large statement to trigger the wraparound. The exploitation probability is unknown due to lack of EPSS data, and the vulnerability is not listed in CISA KEV. Nonetheless, the high potential for code execution and the fact that a single oversized SQL command can trigger the issue make it an attractive local or remote code‑execution opportunity wherever untrusted SQL is processed.