PT-2026-8385 · Unknown · Crypt::Random

Published

2026-01-01

·

Updated

2026-03-04

·

CVE-2026-2474

CVSS v3.1

7.5

High

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Crypt::URandom versions 0.41 through 0.55
Description The Perl module Crypt::URandom is susceptible to a heap buffer overflow within the crypt urandom getrandom() function. The issue arises because the function does not properly validate the length parameter, allowing a negative value to be supplied. This leads to an integer wraparound during memory allocation, resulting in a zero-byte allocation followed by a call to getrandom() with a large, unsigned value. This can cause writes beyond the allocated buffer, leading to heap memory corruption and a denial of service. Applications that pass untrusted input to this parameter may be particularly vulnerable.
Recommendations Update Crypt::URandom to a version newer than 0.55.

Fix

DoS

Heap Based Buffer Overflow

Weakness Enumeration

CWE-1284CWE-122

Related Identifiers

CVE-2026-2474

Affected Products

Crypt::Random