CVE-2026-57433: storable before 3.41 (exclusive); +1 more affected products

Affected technology

storable · before 3.41 (exclusive)
nwclark

Storable · 0 to before 3.41
HAARG

Description’s affected range: versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one

Component: Not specified by the source
Function: retrieve_hook_common
File: Storable.xs

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 3.1 assessment (base score 9.8/10) rates confidentiality, integrity and availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.