# CVE-2026-73194: DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse CVE-2026-73194 is fixed in 5 products on 1 platform, first by libdbi-perl 1.640-1ubuntu0.3+esm3, released August 15, 2026. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2026-73194 - Priority: High - CVSS: 9.1 (Important) - EPSS: 0.0049 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Aug 15, 2026 - Weakness: Improper Validation of Specified Quantity in Input - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-73194 ## Description DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse. preparse reserves seven output bytes per input byte, the width of the longest ':p99999' expansion. The ':N' branch parses the number with `atoi(src)` and assigns it to the binder counter with no range check, so a statement containing ':2147483648' leaves the counter negative (-2147483648 with glibc, where atoi wraps). Each following '?' then expands through `sprintf(start, ":p%d", idx++)` to ':p-2147483648', 14 bytes with the terminating NUL where the buffer budgets 7. The placeholder limit added in 1.650 tests the counter against 99,999, which a negative counter passes. Any caller that preparses an untrusted statement into ':pN' style placeholders gets a heap out-of-bounds write that grows with the number of '?' marks following the poisoned placeholder. The '?' and '%s' return styles compare the parsed number against the expected sequence and error out, and are unaffected. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | libdbi-perl Debian 12.15 (bookworm) | 1.643-4+deb12u2 | [DEBIAN-CVE-2026-73194](https://patchblox.com/security/data/fix/linux/debian-cve-2026-73194.md) | Aug 25, 2026 | | Linux | libdbi-perl Debian 13.5 (trixie) | 1.652-2~deb13u1 | [DEBIAN-CVE-2026-73194](https://patchblox.com/security/data/fix/linux/debian-cve-2026-73194.md) | Aug 25, 2026 | | Linux | libdbi-perl Debian 14 | 1.652-1 | [DEBIAN-CVE-2026-73194](https://patchblox.com/security/data/fix/linux/debian-cve-2026-73194.md) | Aug 25, 2026 | | Linux | libdbi-perl Ubuntu 18.04.6 LTS (bionic) | 1.640-1ubuntu0.3+esm3 | [libdbi-perl 1.640-1ubuntu0.3+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libdbi-perl-1.640-1ubuntu0.3-esm3.md) | Aug 15, 2026 | | Linux | libdbi-perl Ubuntu 20.04 LTS (focal) | 1.643-1ubuntu0.1+esm3 | [libdbi-perl 1.643-1ubuntu0.1+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libdbi-perl-1.643-1ubuntu0.1-esm3.md) | Aug 15, 2026 | | Linux | libdbi-perl Ubuntu 22.04.1 LTS (jammy) | 1.643-3ubuntu0.3 | [libdbi-perl 1.643-3ubuntu0.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libdbi-perl-1.643-3ubuntu0.3.md) | Aug 15, 2026 | | Linux | libdbi-perl Ubuntu 24.04.5 LTS (noble) | 1.643-4ubuntu0.3 | [libdbi-perl 1.643-4ubuntu0.3](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libdbi-perl-1.643-4ubuntu0.3.md) | Aug 15, 2026 | | Linux | libdbi-perl Ubuntu 26.04.1 LTS (resolute) | 1.647-1ubuntu0.26.04.3 | [libdbi-perl 1.647-1ubuntu0.26.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libdbi-perl-1.647-1ubuntu0.26.04.3.md) | Aug 15, 2026 | | Linux | perl-DBI RHEL 10 | 1.643-26.el10_2.6 | [RHSA-2026:70753](https://patchblox.com/security/data/fix/linux/rhsa-2026-70753.md) | Aug 15, 2026 | | Linux | perl-DBI RHEL 8 | 0:1.641-3.el8_10 | [RHSA-2026:71608](https://patchblox.com/security/data/fix/linux/rhsa-2026-71608.md) | Sep 22, 2026 | | Linux | perl-DBI RHEL 9 | 0:1.643-9.el9_8.6 | [RHSA-2026:71422](https://patchblox.com/security/data/fix/linux/rhsa-2026-71422.md) | Sep 24, 2026 | | Linux | perl-DBI almalinux 10 | 1.643-26.el10_2.6 | [ALSA-2026:70753](https://patchblox.com/security/data/fix/linux/alsa-2026-70753.md) | Sep 23, 2026 | | Linux | perl-DBI almalinux 8 | 1.641-3.el8_10 | [ALSA-2026:71608](https://patchblox.com/security/data/fix/linux/alsa-2026-71608.md) | Sep 24, 2026 | | Linux | perl-DBI almalinux 9 | 1.643-9.el9_8.6 | [ALSA-2026:71422](https://patchblox.com/security/data/fix/linux/alsa-2026-71422.md) | Sep 24, 2026 | | Linux | perl-DBI amzn 2023 | 1.652-1.amzn2023.0.1 | [ALAS2023-2026-2075](https://patchblox.com/security/data/fix/linux/alas2023-2026-2075.md) | Aug 31, 2026 | | Linux | perl-DBI ol 10 | 0:1.643-26.el10_2.6 | [ELSA-2026-70753](https://patchblox.com/security/data/fix/linux/elsa-2026-70753.md) | Sep 23, 2026 | | Linux | perl-DBI ol 8 | 0:1.641-10.module+el8.10.0+91039+7b6b05e5 | [ELSA-2026-69112](https://patchblox.com/security/data/fix/linux/elsa-2026-69112.md) | Sep 24, 2026 | | Linux | perl-DBI ol 9 | 0:1.643-9.el9_8.6 | [ELSA-2026-71422](https://patchblox.com/security/data/fix/linux/elsa-2026-71422.md) | Sep 24, 2026 | | Linux | perl-DBI rocky 10 | 0:1.643-26.el10_2.6 | [RLSA-2026:70753](https://patchblox.com/security/data/fix/linux/rlsa-2026-70753.md) | Sep 23, 2026 | | Linux | perl-DBI rocky 8 | 0:1.641-3.el8_10 | [RLSA-2026:71608](https://patchblox.com/security/data/fix/linux/rlsa-2026-71608.md) | Sep 26, 2026 | | Linux | perl-DBI rocky 9 | 0:1.643-9.el9_8.6 | [RLSA-2026:71422](https://patchblox.com/security/data/fix/linux/rlsa-2026-71422.md) | Sep 25, 2026 | | Linux | perl-DBI-debuginfo amzn 2023 | 1.652-1.amzn2023.0.1 | [ALAS2023-2026-2075](https://patchblox.com/security/data/fix/linux/alas2023-2026-2075.md) | Aug 31, 2026 | | Linux | perl-DBI-debugsource amzn 2023 | 1.652-1.amzn2023.0.1 | [ALAS2023-2026-2075](https://patchblox.com/security/data/fix/linux/alas2023-2026-2075.md) | Aug 31, 2026 | | Linux | perl-DBI-tests amzn 2023 | 1.652-1.amzn2023.0.1 | [ALAS2023-2026-2075](https://patchblox.com/security/data/fix/linux/alas2023-2026-2075.md) | Aug 31, 2026 | --- Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.