CVE-2026-60082: hmbrand dbi Out-of-bounds Read
Vulnerability summary
CVE-2026-60082 is a critical (CVSS 9.1) Out-of-bounds Read vulnerability in hmbrand dbi. EPSS estimates a 0.65% chance of exploitation in the next 30 days, higher than 50.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 8 · Related 7Timeline
- 14-07-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row. When the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index. This could be triggered by a caller supplying inconsistent metadata and rows to the prepare method.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · AlpineEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- OSV · DebianEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- NVDNIST9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
EPSS trend
Probability
0.65%
Chance of exploitation in the next 30 days
Percentile
51%
Versus all other CVEs
30-day change
+0.27 pp
From 0.39% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- perl-dbi< 1.651-r0
Debian1 product
- libdbi-perl< 1.643-4+deb12u2 | < 1.652-2~deb13u1 | < 1.651-1
Hmbrand1 product
- dbi< 1.651
Ubuntu1 product
- libdbi-perlAll versions (No fix recorded)
4 vendors · 4 products
