The bug arises from the XS::Parse::Infix wrapper incorrectly using SvRV() instead of SvROK() to validate array references. This causes the wrapper to read a value that is not a reference, leading to a memory access at a user‑specified address. When an attacker supplies crafted data—such as a number or a specially constructed string—in a list used by an XS::Parse::Infix‑based operator, the interpreter can dereference arbitrary memory, potentially causing a segmentation fault or leaking internal memory contents. The vulnerability represents a type‑confusion and out‑of‑bounds read, matching CWE‑843 and CWE‑125.

Affected systems use the XS::Parse::Keyword module in Perl. Versions 0.40 through 0.49 contain the flaw; applications that load these modules and employ operators defined with this parser (e.g., Syntax::Operator::Zip) are susceptible. The flaw is triggered when the module processes input that includes untrusted data, such as decoded JSON or other API payloads.

While no known public exploit is listed in CISA KEV, the CVSS score of 7.5 indicates high severity, and the EPSS score of < 1% shows a low but nonzero likelihood of exploitation. The potential for arbitrary memory corruption indicates significant risk. Adversaries could trigger the vulnerability via web services, command‑line tools, or any interface that accepts user input. Successful exploitation could crash the interpreter, leak internal memory contents, but there is no evidence it would allow arbitrary code execution.