CVE-2026-12844: Heap Buffer Overflow in List::Util::XS pairwise() Function

Technical summary

CVE-2026-12844 describes a heap buffer overflow in List::Util::XS versions prior to 0.59. The pairwise() function allocates a heap buffer sized to accommodate the longer of two input arrays. When storing the return values from the user-supplied block, the allocation grows using a single quadrupling operation (alloc <<= 2) before copying results. The vulnerability manifests when a block call returns more than four times the current allocation in a single invocation; this single quadrupling step is insufficient to contain the output, causing the copy operation to write past the buffer boundary and corrupt heap memory. The affected code path requires that the block's return value for a single pair exceeds four times the size of the longer input array. This is classified as a heap-based buffer overflow (CWE-122, CWE-787).

Business impact

Denial of service is the primary risk: a crafted or unexpected block return value triggers heap corruption, causing the Perl process to crash and interrupt service. In environments where pairwise() is used to process user-controlled data or dynamic inputs, this becomes a reliable DoS vector. Secondary risk depends on heap layout and attacker control; memory corruption in the heap can theoretically be leveraged for code execution, though no public exploitation techniques are documented. For organizations maintaining Perl-based infrastructure (data pipelines, automation, CPAN-dependent applications), this creates operational instability if the vulnerable module version is in active use.

Affected systems

List::Util::XS versions before 0.59 are affected. Any Perl application or service that explicitly imports and calls the pairwise() function from this module is at risk. This includes CPAN-dependent ecosystems, Perl-based web frameworks, data processing pipelines, and automation scripts. The vulnerability does not affect List::Util's pure-Perl fallback implementation, only the XS (C extension) accelerated version. Systems running older Perl distributions that bundle pre-0.59 List::Util::XS are particularly vulnerable. Verify your installed version using 'perl -MList::Util::XS -e "print \$List::Util::XS::VERSION"'.

Exploitability

Exploitation requires an attacker to control or influence the block code passed to pairwise() or to supply input data that causes the block to return a sufficiently large result. The barrier to exploitation depends on the application's architecture: if pairwise() is called with static, known-safe blocks, the risk is lower. If the block is derived from user input, configuration, or plugin code, or if input arrays are user-controlled and influence block output size, exploitation becomes more straightforward. The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible attack vector with no authentication required and a denial-of-service impact. Code execution is theoretically possible but not straightforward without additional heap feng shui or information disclosure.

Remediation

Upgrade List::Util::XS to version 0.59 or later. For CPAN-managed installations, run 'cpan -i List::Util::XS' or 'cpanm List::Util::XS' to fetch and install the patched version. Alternatively, use the pure-Perl fallback by uninstalling the XS module (though this sacrifices performance). Verify the upgrade with 'perl -MList::Util::XS -e "print \$List::Util::XS::VERSION"' to confirm version 0.59+. If immediate patching is not possible, audit all calls to pairwise() in your codebase to understand whether untrusted input flows into the function or whether block return sizes are bounded.

Patch guidance

Update List::Util::XS to version 0.59 or later through your Perl module manager (cpan, cpanm, conda, or your distribution's package manager). Verify the patch by checking the module version after installation. In containerized environments, rebuild images with the patched dependency. In monolithic Perl installations, update the module and restart affected services (web servers, daemons, cron jobs). Test that pairwise() continues to function correctly in your application post-patch; the fix aligns memory allocation with actual buffer requirements, so behavior should be identical for legitimate use cases.

Detection guidance

Monitor for process crashes or segmentation faults in Perl applications, particularly those known to use List::Util::XS. Review application logs for abnormal termination. If possible, instrument pairwise() calls to log block invocations and return value sizes; a return size exceeding four times the input array length is a warning sign. Scan your CPAN dependency tree and lock files (cpanfile, Makefile.PL, dist.ini) to identify which projects or services depend on List::Util::XS and their current version constraints. Use 'perl -MList::Util::XS -e' to query installed versions across your infrastructure.

Why prioritize this

This vulnerability warrants prompt patching due to its HIGH severity, the ease of triggering a denial of service (no authentication or interaction required), and the commonality of pairwise() in data processing workflows. While exploitation for code execution is not straightforward, heap corruption is unpredictable and can occasionally be weaponized. The fix is mature (version 0.59 was released to address this specific flaw) and carries minimal upgrade risk. Prioritize systems running Perl-based services, batch jobs, or automation that depend on List::Util::XS.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) assigns HIGH severity due to the high impact of availability loss (the denial-of-service consequence of heap corruption) combined with a network attack vector (AV:N), low attack complexity (AC:L), and no privilege or interaction requirements (PR:N/UI:N). Confidentiality and integrity are scored as not impacted (C:N/I:N) because the vulnerability does not leak secrets or directly enable arbitrary writes, though heap corruption can theoretically lead to information disclosure or code execution under specific heap layout conditions. This score appropriately reflects the practical threat: an attacker can reliably crash a service but cannot obviously steal data or gain command execution without additional exploitation techniques.

Frequently asked questions