CVE-2026-74766

8.4 HIGHpublic exploit available

Published 2026-09-22 · Updated 2026-09-22

AI risk analysis

Summary: The flaw allows heap use-after-free via a decoded code point that reallocates the output buffer, leading to potential memory corruption.
Exploitability: Exploitation is moderately hard, requiring an attacker to supply a specific punycode label that triggers the buffer reallocation.
Blast radius: If exploited, this could lead to arbitrary code execution or data corruption, impacting the system's integrity and availability.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to Net::IDN::Punycode version 2.590 or later.

heap-use-after-freememory-corruptionperlbuffer-overflow

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decode_punycode. The XS backend inserts each decoded code point into the string buffer of the scalar it returns. decode_punycode computes the insertion pointer first and only then grows the buffer when the code point does not fit. The growth reallocates the buffer and updates every pointer except the insertion pointer, so the move that follows and the write of the code point go through a freed pointer. The buffer starts at twice the label length, and a code point above U+FFFF takes four bytes in the output, so a label of such code points outgrows it and forces the reallocation. Version 2.301, the fix for CVE-2016-15059, introduced the defect. Only the XS backend is affected. Decoding an attacker-supplied punycode label reads and writes freed heap memory.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-416

Public exploit & PoC references

References

Data: NVD (public domain). Analysis: local $0 model. Defensive use only.