CVE-2017-20230

CVE-2017-20230 is a stack overflow vulnerability affecting Storable versions prior to 3.05, a widely-used Perl serialization module. The flaw exists in the retrieve_hook function, which inconsistently handles class name length validation by storing the value as a signed integer but treating it as unsigned during read operations. This inconsistency allows attackers to craft malicious serialized data that triggers a stack overflow condition. The vulnerability carries a critical CVSS 3.1 score of 10.0 with an attack vector that is network-based, requires no authentication or user interaction, and impacts confidentiality, integrity, and availability across the system boundary. The attack requires low complexity and can be executed by any unauthenticated remote attacker, making it highly exploitable from a practical standpoint. The vulnerability is currently listed on the CISA Known Exploited Vulnerabilities catalog as actively exploited in the wild, indicating real-world attack activity. The EPSS score of 0.00026 reflects the historical prevalence data, though active exploitation status takes precedence in threat prioritization. Given the critical severity, active exploitation status, and ease of attack delivery, this vulnerability warrants immediate patching for any systems running affected Storable versions.