# CVE-2026-12087: Socket versions before 2.041 for Perl have an out-of-bounds heap read CVE-2026-12087 is fixed in 18 products on 1 platform, first by DEBIAN-CVE-2026-12087, released June 24, 2026. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2026-12087 - Priority: High - CVSS: 9.1 (Important) - EPSS: 0.0057 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Jun 15, 2026 - Weakness: Out-of-bounds Read - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-12087 ## Description Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | libperl5.26 Ubuntu 18.04.6 LTS (bionic) | 5.26.1-6ubuntu0.7+esm3 | [libperl5.26 5.26.1-6ubuntu0.7+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libperl5.26-5.26.1-6ubuntu0.7-esm3.md) | Jul 13, 2026 | | Linux | libperl5.30 Ubuntu 20.04 LTS (focal) | 5.30.0-9ubuntu0.5+esm3 | [libperl5.30 5.30.0-9ubuntu0.5+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libperl5.30-5.30.0-9ubuntu0.5-esm3.md) | Jul 13, 2026 | | Linux | libperl5.34 Ubuntu 22.04.1 LTS (jammy) | 5.34.0-3ubuntu1.8 | [libperl5.34 5.34.0-3ubuntu1.8](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libperl5.34-5.34.0-3ubuntu1.8.md) | Jul 13, 2026 | | Linux | libperl5.38t64 Ubuntu 24.04.5 LTS (noble) | 5.38.2-3.2ubuntu0.4 | [libperl5.38t64 5.38.2-3.2ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libperl5.38t64-5.38.2-3.2ubuntu0.4.md) | Jul 13, 2026 | | Linux | libperl5.40 Ubuntu 26.04.1 LTS (resolute) | 5.40.1-7ubuntu0.3 | [libperl5.40 5.40.1-7ubuntu0.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libperl5.40-5.40.1-7ubuntu0.3.md) | Jul 13, 2026 | | Linux | libsocket-perl Debian 13.5 (trixie) | 2.038-1+deb13u1 | [DEBIAN-CVE-2026-12087](https://patchblox.com/security/data/fix/linux/debian-cve-2026-12087.md) | Jun 24, 2026 | | Linux | libsocket-perl Debian 14 | 2.041-1 | [DEBIAN-CVE-2026-12087](https://patchblox.com/security/data/fix/linux/debian-cve-2026-12087.md) | Jun 24, 2026 | | Linux | perl Debian 12.15 (bookworm) | 5.36.0-7+deb12u4 | [DEBIAN-CVE-2026-12087](https://patchblox.com/security/data/fix/linux/debian-cve-2026-12087.md) | Jun 24, 2026 | | Linux | perl Debian 13.5 (trixie) | 5.40.1-6+deb13u1 | [DEBIAN-CVE-2026-12087](https://patchblox.com/security/data/fix/linux/debian-cve-2026-12087.md) | Jun 24, 2026 | | Linux | perl Debian 14 | 5.42.3-1 | [DEBIAN-CVE-2026-12087](https://patchblox.com/security/data/fix/linux/debian-cve-2026-12087.md) | Jun 24, 2026 | | Linux | perl Ubuntu 18.04.6 LTS (bionic) | 5.26.1-6ubuntu0.7+esm3 | [perl 5.26.1-6ubuntu0.7+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-perl-5.26.1-6ubuntu0.7-esm3.md) | Jul 13, 2026 | | Linux | perl Ubuntu 20.04 LTS (focal) | 5.30.0-9ubuntu0.5+esm3 | [perl 5.30.0-9ubuntu0.5+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-focal-perl-5.30.0-9ubuntu0.5-esm3.md) | Jul 13, 2026 | | Linux | perl Ubuntu 22.04.1 LTS (jammy) | 5.34.0-3ubuntu1.8 | [perl 5.34.0-3ubuntu1.8](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-perl-5.34.0-3ubuntu1.8.md) | Jul 13, 2026 | | Linux | perl Ubuntu 24.04.5 LTS (noble) | 5.38.2-3.2ubuntu0.4 | [perl 5.38.2-3.2ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-noble-perl-5.38.2-3.2ubuntu0.4.md) | Jul 13, 2026 | | Linux | perl Ubuntu 26.04.1 LTS (resolute) | 5.40.1-7ubuntu0.3 | [perl 5.40.1-7ubuntu0.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-perl-5.40.1-7ubuntu0.3.md) | Jul 13, 2026 | | Linux | perl opensuse-leap 16.0 | 5.42.0-160000.3.1 | [OPENSUSE-SU-2026:21411-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21411-1.md) | Jul 22, 2026 | | Linux | perl sles 15.6 | 5.26.1-150300.17.23.1 | [SUSE-SU-2026:3558-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3558-1.md) | Aug 10, 2026 | | Linux | perl sles 15.7 | 5.26.1-150300.17.23.1 | [SUSE-SU-2026:3558-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3558-1.md) | Aug 10, 2026 | | Linux | perl sles 16.0 | 5.42.0-160000.3.1 | [SUSE-SU-2026:22847-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22847-1.md) | Jul 22, 2026 | | Linux | perl-Socket amzn 2023 | 4:2.032-1.amzn2023.0.4 | [ALAS2023-2026-2161](https://patchblox.com/security/data/fix/linux/alas2023-2026-2161.md) | Sep 14, 2026 | | Linux | perl-Socket-debuginfo amzn 2023 | 4:2.032-1.amzn2023.0.4 | [ALAS2023-2026-2161](https://patchblox.com/security/data/fix/linux/alas2023-2026-2161.md) | Sep 14, 2026 | | Linux | perl-Socket-debugsource amzn 2023 | 4:2.032-1.amzn2023.0.4 | [ALAS2023-2026-2161](https://patchblox.com/security/data/fix/linux/alas2023-2026-2161.md) | Sep 14, 2026 | | Linux | perl-Socket-tests amzn 2023 | 4:2.032-1.amzn2023.0.4 | [ALAS2023-2026-2161](https://patchblox.com/security/data/fix/linux/alas2023-2026-2161.md) | Sep 14, 2026 | | Linux | perl-base Ubuntu 18.04.6 LTS (bionic) | 5.26.1-6ubuntu0.7+esm3 | [perl-base 5.26.1-6ubuntu0.7+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-perl-base-5.26.1-6ubuntu0.7-esm3.md) | Jul 13, 2026 | | Linux | perl-base Ubuntu 20.04 LTS (focal) | 5.30.0-9ubuntu0.5+esm3 | [perl-base 5.30.0-9ubuntu0.5+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-focal-perl-base-5.30.0-9ubuntu0.5-esm3.md) | Jul 13, 2026 | | Linux | perl-base Ubuntu 22.04.1 LTS (jammy) | 5.34.0-3ubuntu1.8 | [perl-base 5.34.0-3ubuntu1.8](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-perl-base-5.34.0-3ubuntu1.8.md) | Jul 13, 2026 | | Linux | perl-base Ubuntu 24.04.5 LTS (noble) | 5.38.2-3.2ubuntu0.4 | [perl-base 5.38.2-3.2ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-noble-perl-base-5.38.2-3.2ubuntu0.4.md) | Jul 13, 2026 | | Linux | perl-base Ubuntu 26.04.1 LTS (resolute) | 5.40.1-7ubuntu0.3 | [perl-base 5.40.1-7ubuntu0.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-perl-base-5.40.1-7ubuntu0.3.md) | Jul 13, 2026 | | Linux | perl-debug Ubuntu 18.04.6 LTS (bionic) | 5.26.1-6ubuntu0.7+esm3 | [perl-debug 5.26.1-6ubuntu0.7+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-perl-debug-5.26.1-6ubuntu0.7-esm3.md) | Jul 13, 2026 | | Linux | perl-debug Ubuntu 20.04 LTS (focal) | 5.30.0-9ubuntu0.5+esm3 | [perl-debug 5.30.0-9ubuntu0.5+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-focal-perl-debug-5.30.0-9ubuntu0.5-esm3.md) | Jul 13, 2026 | | Linux | perl-debug Ubuntu 22.04.1 LTS (jammy) | 5.34.0-3ubuntu1.8 | [perl-debug 5.34.0-3ubuntu1.8](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-perl-debug-5.34.0-3ubuntu1.8.md) | Jul 13, 2026 | | Linux | perl-debug Ubuntu 24.04.5 LTS (noble) | 5.38.2-3.2ubuntu0.4 | [perl-debug 5.38.2-3.2ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-noble-perl-debug-5.38.2-3.2ubuntu0.4.md) | Jul 13, 2026 | | Linux | perl-debug Ubuntu 26.04.1 LTS (resolute) | 5.40.1-7ubuntu0.3 | [perl-debug 5.40.1-7ubuntu0.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-perl-debug-5.40.1-7ubuntu0.3.md) | Jul 13, 2026 | | Linux | perl-modules-5.26 Ubuntu 18.04.6 LTS (bionic) | 5.26.1-6ubuntu0.7+esm3 | [perl-modules-5.26 5.26.1-6ubuntu0.7+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-perl-modules-5.26-5.26.1-6ubuntu0.7-esm3.md) | Jul 13, 2026 | | Linux | perl-modules-5.30 Ubuntu 20.04 LTS (focal) | 5.30.0-9ubuntu0.5+esm3 | [perl-modules-5.30 5.30.0-9ubuntu0.5+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-focal-perl-modules-5.30-5.30.0-9ubuntu0.5-esm3.md) | Jul 13, 2026 | | Linux | perl-modules-5.34 Ubuntu 22.04.1 LTS (jammy) | 5.34.0-3ubuntu1.8 | [perl-modules-5.34 5.34.0-3ubuntu1.8](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-perl-modules-5.34-5.34.0-3ubuntu1.8.md) | Jul 13, 2026 | | Linux | perl-modules-5.38 Ubuntu 24.04.5 LTS (noble) | 5.38.2-3.2ubuntu0.4 | [perl-modules-5.38 5.38.2-3.2ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-noble-perl-modules-5.38-5.38.2-3.2ubuntu0.4.md) | Jul 13, 2026 | | Linux | perl-modules-5.40 Ubuntu 26.04.1 LTS (resolute) | 5.40.1-7ubuntu0.3 | [perl-modules-5.40 5.40.1-7ubuntu0.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-perl-modules-5.40-5.40.1-7ubuntu0.3.md) | Jul 13, 2026 | --- Data as of 2026-11-09T19:38:12Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.