HTML::Entities versions prior to 3.84 contain a use‑after‑free bug in the _decode_entities routine. The routine caches a pointer into a string that may be freed later, so that a subsequent copy operation reads data from a reclaimed heap region. This flaw can lead to disclosure of adjacent heap contents when copying from the freed buffer, potentially exposing sensitive data. The weakness is a classic use‑after‑free issue as classified by CWE‑416.

The vulnerability impacts the HTML::Entities Perl module, distributed by OALDERS. All released versions before 3.84 are affected. Systems that load this library, such as Perl applications that parse or render user‑supplied HTML using HTML::Entities, are at risk unless they have upgraded to version 3.84 or later.

The flaw permits arbitrary read of freed memory. The CVSS score of 7.5 indicates high severity. The EPSS score is 0.00017, indicating a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The exploit requires local execution of code that uses the vulnerable library; an attacker would need to supply crafted entity references that trigger the freed memory copy path. Thus the attack surface is limited to environments where untrusted input can be processed by the module.