A heap out‑of‑bounds write occurs in the quote_float function of DBD::Pg 3.21.0, which miscalculates the buffer length for special numeric literals such as NaN and Infinity. The function allocates only the length of the literal plus a null terminator, but then emits the literal surrounded by single quotes, causing a two‑byte overflow. This overflow corrupts adjacent heap memory and can lead to memory corruption, potentially enabling arbitrary code execution or a denial of service.

Perl applications that use the DBD::Pg database driver version 3.21.0. The module is distributed by the Bucardo project on GitHub and is commonly used in Perl environments that interface with PostgreSQL.

The CVE has a CVSS score of 9.8 and an EPSS score of < 1%, but the nature of the vulnerability—an unchecked heap write—implies high severity. The exploit is achievable via the $dbh->quote call when the application passes a numeric value like Infinity with the SQL_NUMERIC type, a scenario that can occur in both remote client code or local scripts. While no active exploit is listed in KEV, the vulnerability poses a serious risk if an attacker can supply such input to the quoting function.