> CVE-2026-2597

« BACK_TO_HOME
PUBLISHED
2026-02-27 00:16
MODIFIED
2026-02-27 00:16
EPSS (Prob. Exploit)
0.34%
Top 72.1%
DATA SOURCES:
NVD 🔗 2026-02-27 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-10-28 OSV 🔗 2026-11-08

> DESCRIPTION

Crypt::SysRandom::XS versions before 0.010 for Perl is vulnerable to a heap buffer overflow in the XS function random_bytes(). The function does not validate that the length parameter is non-negative. If a negative value (e.g. -1) is supplied, the expression length + 1u causes an integer wraparound, resulting in a zero-byte allocation. The subsequent call to chosen random function (e.g. getrandom) passes the original negative value, which is implicitly converted to a large unsigned value (typically SIZE_MAX). This can result in writes beyond the allocated buffer, leading to heap memory corruption and application crash (denial of service). In common usage, the length argument is typically hardcoded by the caller, which reduces the likelihood of attacker-controlled exploitation. Applications that pass untrusted input to this parameter may be affected.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-122 CWE-1284

> CWE DETAILED DESCRIPTIONS

CWE-122: Heap-based Buffer Overflow - The product writes past the end of a buffer that was allocated on the heap. | CWE-1284: Improper Validation of Specified Quantity in Input - The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

> GITHUB SECURITY ADVISORY

GHSA-8mpr-6xr2-chhc MODERATE

ImageMagick: MSL - Stack overflow in ProcessMSLScript

AFFECTED PACKAGES:
NUGET / Magick.NET-Q8-x86
< 14.10.3
Fixed in: 14.10.3
NUGET / Magick.NET-Q8-x64
< 14.10.3
Fixed in: 14.10.3
NUGET / Magick.NET-Q8-arm64
< 14.10.3
Fixed in: 14.10.3
NUGET / Magick.NET-Q8-OpenMP-x64
< 14.10.3
Fixed in: 14.10.3
NUGET / Magick.NET-Q8-OpenMP-arm64
< 14.10.3
Fixed in: 14.10.3
NUGET / Magick.NET-Q8-AnyCPU
< 14.10.3
Fixed in: 14.10.3
NUGET / Magick.NET-Q16-HDRI-OpenMP-x64
< 14.10.3
Fixed in: 14.10.3
NUGET / Magick.NET-Q16-x86
< 14.10.3
Fixed in: 14.10.3
NUGET / Magick.NET-Q16-x64
< 14.10.3
Fixed in: 14.10.3
NUGET / Magick.NET-Q16-arm64
< 14.10.3
Fixed in: 14.10.3

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Crypt::SysRandom::XS versions before 0.010 for Perl is vulnerable to a heap buffer overflow in the XS function random_bytes()

AFFECTED PACKAGES:
Unknown / Unknown
9 versions affected

> HISTORIQUE DES MODIFICATIONS

Première apparition
27/02/2026 00:16
Source: NVD
📊 ENRICHISSEMENT 01/11/2026 06:58
CWE
Champ modifié: Description CWE
Ancienne valeur:
CWE-122: Heap-based Buffer Overflow - A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the bu...
Nouvelle valeur:
CWE-122: Heap-based Buffer Overflow - The product writes past the end of a buffer that was allocated on the heap. | CWE-1284: Improper Validation of Specified Quantity in Input - The product receives ...
📊 ENRICHISSEMENT 01/03/2026 06:46
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-122: Heap-based Buffer Overflow - A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the bu...
Total des modifications: 2 Dernière mise à jour: 1 week ago

> REFERENCES

https://metacpan.org/dist/Crypt-SysRandom-XS/changes
https://metacpan.org/release/LEONT/Crypt-SysRandom-XS-0.011/source/lib/Crypt/Sys...
« BACK_TO_HOME