CVE-2026-10879: hmbrand dbi Out-of-bounds Write
Vulnerability summary
CVE-2026-10879 is a critical (CVSS 9.8) Out-of-bounds Write vulnerability in hmbrand dbi. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 40.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 10 · Related 6Timeline
- 05-06-2026PublishedVulnerability first disclosed.
- 08-06-2026Last modifiedVulnerability information updated.
Description
DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders. The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer. Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.48%
Chance of exploitation in the next 30 days
Percentile
41%
Versus all other CVEs
30-day change
0.00 pp
From 0.48% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- perl-dbi< 1.648-r0
Debian1 product
- libdbi-perl< 1.643-4+deb12u1 | < 1.647-1+deb13u1 | < 1.648-1
Hmbrand1 product
- dbi< 1.648
Perl1 product
- dbi< 1.648
Ubuntu1 product
- libdbi-perl< 1.630-1ubuntu0.1~esm6 | < 1.634-1ubuntu0.2+esm2 | < 1.640-1ubuntu0.3+esm1 | < 1.643-1ubuntu0.1+esm1 | < 1.643-3ubuntu0.1 | < 1.643-4ubuntu0.1 | < 1.647-1ubuntu0.25.10.1 | < 1.647-1ubuntu0.26.04.1
5 vendors · 5 products
