CVE-2026-12087 Socket versions before 2.041 for Perl have an out-of-bounds heap read

Critical 9.1 Published 15 Jun 2026 Updated 16 Jun 2026

An out-of-bounds heap read in the Perl Socket library allows attackers to disclose adjacent memory contents by providing a short source address.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-12087?

CVE-2026-12087 is a critical memory corruption vulnerability in PEVANS Socket, published on 15 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Socket versions before 2.041 for Perl have an out-of-bounds heap read.

In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.

Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.

Weakness: CWE-805, CWE-125

Which versions are affected by CVE-2026-12087?

Linux distribution packages (2)

`perl-Socket` Red Hat:hummingbird:1	All versions	`0:2.041-1.hum1`
`perl-Socket-tests` Red Hat:hummingbird:1	All versions	`0:2.041-1.hum1`

How do I fix CVE-2026-12087?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-12087 being exploited?

There is no known exploitation of CVE-2026-12087 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as AZL-90156, DEBIAN-CVE-2026-12087, ECHO-31e4-d78e-2b62, GHSA-q5cv-5vf6-95gp, MGASA-2026-0251, OESA-2026-2843 and 6 more.