Sereal::Decoder for Perl contains a heap out‑of‑bounds read vulnerability in its decoder logic. When processing a COPY tag, the decoder reinterprets a target byte as a new tag. If that byte matches a SHORT_BINARY pattern, the read is not bounded to the COPY tag’s own offset and can escape past the end of the input buffer. This flaw can cause up to 31 bytes after the COPY offset to be read as a class name or hash key, exposing arbitrary heap data. The weakness is classified as CWE‑125.

Affected are all installations of the YVES Sereal::Decoder module using a version before 5.005. The fix is available in version 5.005 and later, which implements proper bounds checking before decoding the referenced tag. Only the YVES Sereal::Decoder product is listed; no other vendors are referenced.

No EPSS score is reported, and the vulnerability is not listed in CISA’s KEV catalog. While the precise CVSS score is not provided, the inherent nature of an unbounded read suggests a high severity. The likely attack vector is remote or local depending on who can supply the decoded input; an attacker who can control serialized data can trigger this read by crafting a COPY offset that points to a previously decoded value. Because this can expose sensitive information and may be used to facilitate further attacks, the risk is elevated.