Bug#1149243: libxs-parse-keyword-perl: CVE-2026-85644

[Salvatore Bonaccorso]

Source: libxs-parse-keyword-perl
Version: 0.49-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for libxs-parse-keyword-perl.

CVE-2026-85644[0]:
| XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a
| number as an array reference.  The wrapper function XS::Parse::Infix
| generates for a list-associative infix operator checks whether
| arguments are array references, but it tests using SvRV() rather
| than SvROK(). SvRV() reads a union slot that only holds a referent
| once SvROK(sv) is true, so the guard never validates that it is a
| reference. For an IV or NV that slot holds the number itself, SvRV()
| returns the caller's value and SvTYPE() dereferences it at offset
| 12. This will generally result in a segmentation fault.  An
| application that hands the wrapper a list built from decoded input
| (for example, from JSON) lets whoever supplies a number in that list
| choose the address that the interpreter dereferences.  An ordinary
| string's byte 12 is rarely SVt_PVAV so the guard croaks by luck, but
| an attacker-crafted string carrying 0x0b there passes, and the
| buffer is then used as an AV head, with AvARRAY taken from bytes
| 16-23 and its entries pushed onto the Perl stack as live SVs.  A
| simple proof-of-concept uses the zip operator:      use
| Syntax::Operator::Zip 'zip';      my @args = ([1], 2);
| zip(@args);


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-85644
    https://www.cve.org/CVERecord?id=CVE-2026-85644
[1] https://lists.security.metacpan.org/cve-announce/msg/43916020/

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore