LEONT Crypt::SysRandom::XS prior 0.010 on Perl random_bytes length heap-based overflow

Summaryinfo

A vulnerability identified as critical has been detected in LEONT Crypt::SysRandom::XS on Perl. Impacted is the function random_bytes. This manipulation of the argument length causes heap-based overflow. This vulnerability appears as CVE-2026-2597. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in LEONT Crypt::SysRandom::XS on Perl and classified as critical. Affected by this vulnerability is the function random_bytes. The manipulation of the argument length with an unknown input leads to a heap-based overflow vulnerability. The CWE definition for the vulnerability is CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Crypt::SysRandom::XS versions before 0.010 for Perl is vulnerable to a heap buffer overflow in the XS function random_bytes(). The function does not validate that the length parameter is non-negative. If a negative value (e.g. -1) is supplied, the expression length + 1u causes an integer wraparound, resulting in a zero-byte allocation. The subsequent call to chosen random function (e.g. getrandom) passes the original negative value, which is implicitly converted to a large unsigned value (typically SIZE_MAX). This can result in writes beyond the allocated buffer, leading to heap memory corruption and application crash (denial of service). In common usage, the length argument is typically hardcoded by the caller, which reduces the likelihood of attacker-controlled exploitation. Applications that pass untrusted input to this parameter may be affected.

The advisory is shared at metacpan.org. This vulnerability is known as CVE-2026-2597 since 02/16/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 301801 (Fedora 42 : perl-Crypt-SysRandom-XS (2026-c0123ede74)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.010 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (301801). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• LEONT

Name

• Crypt::SysRandom::XS

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion