========================================================================
CVE-2026-107373                                      CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-107373

   Distribution:  ExtUtils-Typemaps-Default
       Versions:  before 1.06
       MetaCPAN: https://metacpan.org/dist/ExtUtils-Typemaps-Default
       VCS Repo:  https://github.com/tsee/extutils-typemap-default

ExtUtils::Typemaps::STL::String versions before 1.06 for Perl
T_STD_STRING typemap may read the SV length before stringifying the
argument

Description
-----------
ExtUtils::Typemaps::STL::String versions before 1.06 for Perl
T_STD_STRING typemap may read the SV length before stringifying the
argument.

The typemap uses

     $var = std::string( SvPV_nolen($arg), SvCUR($arg) )

However, evaluation order for C++ arguments is not specified, and some
compilers may produce code that evalutes SvCUR($arg) first.

When $arg is not a string (for example, an interger, number or a
reference) then SvCUR will return an invalid value, and the program may
abort or segfault.

Problem types
-------------
- CWE-125 Out-of-bounds Read

Workarounds
-----------
For deployments that cannot be upgraded, ensure that arguments passed
to modules that use ExtUtils::Typemaps::Default are strngified.

Solutions
---------
Upgrade to ExtUtils::Typemaps::Default version 1.06 or later.

Rebuild any modules that use ExtUtils::Typemaps::Default as part of
their build process.

References
----------
https://metacpan.org/release/SMUELLER/ExtUtils-Typemaps-Default-1.06/changes
https://github.com/tsee/extutils-typemap-default/commit/a6b9c298b34ddadc582961403e715d292f82a22d
https://rt.cpan.org/Public/Bug/Display.html?id=94110
https://www.cve.org/CVERecord?id=CVE-2026-80490

Timeline
--------
- 2014-03-22: Issue reported in bugtracker for
   ExtUtils::Typemaps::Default version 1.05.
- 2014-06-10: Fix committed to the repository. Bugtracker issue closed.
- 2026-09-30: Issue reported to CPANSec.
- 2026-10-08: ExtUtils::Typemaps::Default version 1.06 released with a
   fix.