CVE-2026-73194

*** Pendiente de traducción *** DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse.<br /> <br /> preparse reserves seven output bytes per input byte, the width of the longest &amp;#39;:p99999&amp;#39; expansion. The &amp;#39;:N&amp;#39; branch parses the number with `atoi(src)` and assigns it to the binder counter with no range check, so a statement containing &amp;#39;:2147483648&amp;#39; leaves the counter negative (-2147483648 with glibc, where atoi wraps). Each following &amp;#39;?&amp;#39; then expands through `sprintf(start, ":p%d", idx++)` to &amp;#39;:p-2147483648&amp;#39;, 14 bytes with the terminating NUL where the buffer budgets 7. The placeholder limit added in 1.650 tests the counter against 99,999, which a negative counter passes.<br /> <br /> Any caller that preparses an untrusted statement into &amp;#39;:pN&amp;#39; style placeholders gets a heap out-of-bounds write that grows with the number of &amp;#39;?&amp;#39; marks following the poisoned placeholder. The &amp;#39;?&amp;#39; and &amp;#39;%s&amp;#39; return styles compare the parsed number against the expected sequence and error out, and are unaffected.