Net::IDN::Punycode versions prior to 2.590 for Perl contain a flaw that violates integer overflow (CWE‑190), resulting in an out‑of‑bounds read (CWE‑125) in the encode_punycode routine. The unchecked integer overflow occurs while accumulating the delta value, causing the digit index to fall outside the bounds of the 36‑entry digit table and allowing the function to read memory beyond the array. An attacker can trigger this by submitting a crafted domain label that includes specific Unicode code points or a long ASCII string leading to the overflow, which results in either a corrupted output string or a process crash.

The vulnerability is present in the Perl CPAN library Net::IDN::Punycode (also packaged as Net-IDN-Encode) for all releases before commit 2.590-TRIAL. Only the XS backend of the module is affected; the pure Perl implementation is not impacted. Systems that depend on the CPAN library for IDN conversion and use the encode_punycode API are at risk if they have not applied the 2.590-TRIAL update or later.

Because the fault is triggered by a supplied string, an attacker only needs local or remote input to the encode_punycode function, which is a documented public API. The vulnerability can lead to service disruption or memory disclosure, though there is no evidence of executable code execution. The EPSS score indicates a low exploitation probability (< 1%), and the issue is not listed in CISA KEV, indicating current exploitation activity is unknown. Still, the severity of an out-of-bounds read in a widely used IDN library warrants prompt mitigation.