CVE-2026-2474

CVE-2026-2474 describes a heap buffer overflow in Crypt::URandom versions 0.41 through 0.54 for Perl, specifically within the crypt_urandom_getrandom() function, affecting products like ddick crypt. The vulnerability arises from improper validation of the length parameter, allowing a negative value to cause an integer wraparound, leading to a zero-byte allocation followed by an out-of-bounds write. This can result in heap memory corruption and a denial of service (application crash). Rated 7.5 HIGH on CVSS, it has a network attack vector and low attack complexity, but no impact on confidentiality or integrity. There is no evidence of active exploitation, public exploit code, or significant community discussion, and it is not listed on the KEV catalog.