Skip to content
Fencer Intel
critical 9.1

CVE-2026-12087 json

Socket versions before 2.041 for Perl have an out-of-bounds heap read

published 4mo ago modified 15d ago also EUVD-2026-37009

cvss
9.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 47%
public exploits
0
none known

Summary

Socket versions before 2.041 for Perl have an out-of-bounds heap read.

In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.

Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.

Patch / fix

  • PEVANS Socket 2.041
  • perl Debian 12 5.36.0-7+deb12u4
  • perl Debian 13 5.40.1-6+deb13u1
  • perl Debian 14 5.42.3-1
  • libsocket-perl Debian 13 2.038-1+deb13u1
  • libsocket-perl Debian 14 2.041-1

debian advisories DEBIAN-CVE-2026-12087

  • perl Ubuntu 22.04 LTS 5.34.0-3ubuntu1.8
  • perl Ubuntu 24.04 LTS 5.38.2-3.2ubuntu0.4
  • perl Ubuntu 26.04 LTS 5.40.1-7ubuntu0.3
  • perl Ubuntu Pro 14.04 LTS 5.18.2-2ubuntu1.7+esm8
  • perl Ubuntu Pro 16.04 LTS 5.22.1-9ubuntu0.9+esm3
  • perl Ubuntu Pro 18.04 LTS 5.26.1-6ubuntu0.7+esm3
  • perl Ubuntu Pro 20.04 LTS 5.30.0-9ubuntu0.5+esm3

ubuntu advisories UBUNTU-CVE-2026-12087

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • perl-Socket hummingbird 1 2.041-1.hum1
  • perl-Socket-tests hummingbird 1 2.041-1.hum1

red hat advisories RHSA-2026:11342

  • perl SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +13 more 5.26.1-150300.17.23.1
  • perl Linux Micro 6.1 5.38.2-slfo.1.1_3.1
  • perl Linux Micro 6.0 5.38.2-5.1
  • perl SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 5.42.0-160000.3.1
  • perl SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 5.18.2-12.35.1

suse advisories SUSE-SU-2026:3558-1SUSE-SU-2026:3540-1SUSE-SU-2026:23075-1SUSE-SU-2026:23008-1SUSE-SU-2026:22847-1SUSE-SU-2026:22929-1

  • perl openSUSE Leap 16.0 5.42.0-160000.3.1

opensuse advisories openSUSE-SU-2026:21411-1

  • perl Alpine 3.24 5.42.3-r0

alpine advisories ALPINE-CVE-2026-12087

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • perl Azure Linux 3.0 5.38.2-512

azure linux advisories AZL-90156

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2026-12087 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-12087 updated cvss 5.3

perl-Socket: perl-Socket: Information Disclosure due to Out-of-Bounds Read

  • Red Hat Enterprise Linux 6 perl-Socket6 Red Hat Enterprise Linux 7 perl-Socket, perl-Socket6
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 perl-Socket, perl-Socket6 Red Hat Enterprise Linux 9 perl-Socket, perl-Socket6 Red Hat Enterprise Linux 10 perl-Socket, perl-Socket6
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Hardened Images perl-Socket 2.041-1.hum1, perl-Socket-tests 2.041-1.hum1
    fixed: vendor fix RHSA-2026:11342

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
4mo ago

Exploit prediction

0.57% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CNA 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Affected products

  • PEVANS Socket

Classification

Weakness
  • CWE-125 Out-of-bounds Read
  • CWE-805 Buffer Access with Incorrect Length Value

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.