The DBI module for Perl contains a flaw that allows an unvalidated numeric placeholder to be parsed as an out‑of‑range number. When a placeholder such as ':2147483648' is encountered, the binder counter is set to a negative value, so subsequent placeholder expansion writes beyond the allocated buffer. This out‑of‑bounds write can corrupt heap memory and, depending on the environment and data, may enable an attacker to execute arbitrary code or cause a denial of service. The type of weakness is a classic buffer overflow (CWE-787) combined with a lack of input validation (CWE-1284).

Any deployment that uses the Perl DBI library older than version 1.652 is vulnerable. The issue exists in all releases before 1.652, and the 1.650 version only introduced a positive placeholder limit but does not guard against negative counter values. Affected systems include all Perl applications that embed or construct SQL statements through DBI without validating numeric placeholders.

The exploit requires the attacker to supply a crafted SQL statement containing an oversized numeric placeholder. While application logic limits are usually the first line of defence, the vulnerability remains exploitable if inputs are not properly sanitized. EPSS is not available and the issue is not listed in the CISA KEV catalog, but the lack of range checks and the potential for arbitrary memory corruption make the risk high. No public exploit has been documented, yet the severity of a heap overflow means that the vulnerability should be treated with urgency.