CVE-2026-10879

A heap buffer overflow flaw of important severity was found in the perl-DBI Perl database interface module, affecting the perl-DBI packages in Red Hat Enterprise Linux 6, 7, 8, 9, and 10 (including the perl-DBI:1.641 module streams on RHEL 8) and in Red Hat In-Vehicle OS. When the DBI preparse method rewrites a SQL statement containing ? placeholders, each placeholder is expanded to a numbered binder of the form :pN, but the destination buffer was allocated assuming only three characters per binder. A statement with more than 9 placeholders generates binders with two or more digits (for example :p1003), so the expanded statement can exceed the allocated buffer and overflow the heap. An attacker who can influence a SQL statement that an application using the vulnerable preparse path prepares could exploit this to crash the application, causing a denial of service, or potentially achieve memory corruption leading to arbitrary code execution. Red Hat rates this flaw as IMPORTANT with a CVSS 3.1 score of 7.7 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), lower than the CISA score of 9.8 that assumes a network attack vector, because exploitation requires a local application to pass attacker-controlled SQL through the affected preparse code path rather than direct network exposure of the flaw itself, and Red Hat's scoring reflects no direct confidentiality impact. The affected Red Hat Enterprise Linux and Red Hat In-Vehicle OS streams are tracked as AFFECTED, with fixes being pursued for those streams; Fedora is not affected because the vulnerable code is not present in its perl-DBI packages.