[From nobody Tue Sep 29 17:09:07 2026
Received: (at submit) by bugs.debian.org; 28 Sep 2026 18:57:52 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
 (2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-9.9 required=4.0 tests=BAYES_00, FOURLA,
 FROMDEVELOPER, 
 NO_RELAYS,XMAILER_REPORTBUG autolearn=ham autolearn_force=no
 version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 24; hammy, 150; neutral, 97; spammy,
 0. spammytokens: hammytokens:0.000-+--XDebbugsCc,
 0.000-+--X-Debbugs-Cc, 0.000-+--H*F:U*carnil, 0.000-+--H*Ad:N*Bug,
 0.000-+--HTo:N*Debian
Return-path: &lt;carnil@debian.org&gt;
Received: via submission by buxtehude.debian.org with esmtp (Exim 4.96)
 (envelope-from &lt;carnil@debian.org&gt;) id 1xBGXu-008e34-0O
 for submit@bugs.debian.org; Mon, 28 Sep 2026 18:57:52 +0000
Content-Type: text/plain; charset=&quot;us-ascii&quot;
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Salvatore Bonaccorso &lt;carnil@debian.org&gt;
To: Debian Bug Tracking System &lt;submit@bugs.debian.org&gt;
Subject: libxs-parse-keyword-perl: CVE-2026-85644
Message-ID: &lt;179062186733.1112421.5036967128874033143.reportbug@eldamar.lan&gt;
X-Mailer: reportbug 13.2.0+nmu1
Date: Mon, 28 Sep 2026 20:57:47 +0200
Delivered-To: submit@bugs.debian.org

Source: libxs-parse-keyword-perl
Version: 0.49-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team &lt;team@security.debian.org&gt;

Hi,

The following vulnerability was published for libxs-parse-keyword-perl.

CVE-2026-85644[0]:
| XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a
| number as an array reference.  The wrapper function XS::Parse::Infix
| generates for a list-associative infix operator checks whether
| arguments are array references, but it tests using SvRV() rather
| than SvROK(). SvRV() reads a union slot that only holds a referent
| once SvROK(sv) is true, so the guard never validates that it is a
| reference. For an IV or NV that slot holds the number itself, SvRV()
| returns the caller's value and SvTYPE() dereferences it at offset
| 12. This will generally result in a segmentation fault.  An
| application that hands the wrapper a list built from decoded input
| (for example, from JSON) lets whoever supplies a number in that list
| choose the address that the interpreter dereferences.  An ordinary
| string's byte 12 is rarely SVt_PVAV so the guard croaks by luck, but
| an attacker-crafted string carrying 0x0b there passes, and the
| buffer is then used as an AV head, with AvARRAY taken from bytes
| 16-23 and its entries pushed onto the Perl stack as live SVs.  A
| simple proof-of-concept uses the zip operator:      use
| Syntax::Operator::Zip 'zip';      my @args = ([1], 2);
| zip(@args);


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities &amp; Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-85644
    https://www.cve.org/CVERecord?id=CVE-2026-85644
[1] https://lists.security.metacpan.org/cve-announce/msg/43916020/

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore
]