DBI versions prior to 1.652 on 32‑bit Perl compute the preparse output buffer size with a 32‑bit integer, allowing a wraparound on a statement of 613,566,757 bytes. This results in a buffer allocated only 19 bytes in size yet a 585 MB string is copied into it, overwriting heap memory with attacker controlled data. The vulnerability arises from an integer overflow (CWE‑190) followed by an out‑of‑bounds write (CWE‑787). If an attacker can supply such a large statement to preparse, the overflow can corrupt heap structures or inject malicious payloads, leading to loss of integrity or arbitrary code execution.

The flaw affects Perl DBI module versions earlier than 1.652 running on 32‑bit Perl interpreters. Operations that accept untrusted SQL statements on such builds are vulnerable; 64‑bit Perl builds are not impacted because the 32‑bit STRLEN wraparound does not occur.

The flaw is limited to 32‑bit Perl builds; 64‑bit builds would require an impractically large statement to trigger the wraparound. The vulnerability carries a CVSS score of 9.8, indicating critical severity. The EPSS score is below 1% (approximately 0.00199), indicating a low current exploitation probability, and the vulnerability is not listed in CISA KEV. Nonetheless, the high potential for code execution remains, and a single oversized SQL command can trigger the issue wherever untrusted SQL is processed.