CVE-2026-12087: Perl Out-of-Bounds Read

CVE-2026-12087 is a critical out-of-bounds read vulnerability in Perl, published in the National Vulnerability Database (NVD) on June 15, 2026. It carries a CVSS v3.1 base score of 9.1 (Critical). According to its CVSS vector, it can be exploited over the network, needs no privileges and no user interaction.

What is CVE-2026-12087?

Perl Socket's pack_ip_mreq_source() may cause out-of-bounds reads due to improper length checks.

The NVD description reads:

Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.

NVD maps this issue to CWE-125 (Out-of-bounds Read), CWE-805 (Buffer Access with Incorrect Length Value).

Affected versions and packages

NVD does not publish structured version ranges for CVE-2026-12087 at the time of writing, so check the description above and the vendor advisory in the references for the exact affected releases.

Echo's advisory data tracks 4 packages for CVE-2026-12087: libperl5.40, perl, perl-base, perl-modules-5.40.

Echo-built fixed versions recorded for this CVE:

• libperl5.40, perl, perl-modules-5.40: 5.40.1-6+e10, 5.40.1-6+e11, 5.40.1-6+e12, 5.40.1-6+e13 and 4 more
• perl-base: 5.36.0-7+deb12u2-e1, 5.40.1-6+e10, 5.40.1-6+e11, 5.40.1-6+e12 and 6 more

Severity and CVSS score

A score of 9.1 puts CVE-2026-12087 in the Critical range (9.0 to 10.0), the highest CVSS band. The vector shows the attack path and the impact on confidentiality, integrity and availability. For help weighing exploit likelihood against raw severity, see our guide to patching AI-found zero-days before disclosure.

Impact: Out-of-Bounds Read

The CVSS vector rates the impact on confidentiality as high, integrity as none and availability as high. Exploitation requires no privileges and no user interaction, and the attacker reaches the target over the network.

What this means in practice depends on how Perl is used in your environment: how widely it is deployed, whether the affected code path is reachable, and what the process can access. Treat the exposed systems that run a listed version as in scope until you have confirmed otherwise.

Is CVE-2026-12087 being exploited in the wild?

Known exploitation: CISA KEV

No. As of November 4, 2026, CVE-2026-12087 is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog (catalog version 2026.11.03). KEV only lists vulnerabilities with confirmed exploitation, so absence from the catalog is not proof that nobody is exploiting the flaw.

EPSS score and percentile

The Exploit Prediction Scoring System (EPSS) from FIRST estimates the probability that a CVE will see exploitation activity in the next 30 days. On November 3, 2026, CVE-2026-12087 had an EPSS score of 0.006, which corresponds to a probability of 0.57%. It sits at the 47th percentile, which means it is scored as more likely to be exploited than roughly 47% of scored CVEs, placing it below the median of scored CVEs. EPSS is recalculated daily and is a likelihood estimate, not a confirmation, so read it together with KEV status, exposure and CVSS severity.

Attack vector, complexity, privileges and user interaction

Based on the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H (source: CNA), this is how an attacker has to approach CVE-2026-12087:

• Attack vector: Network (AV:N): the flaw can be reached remotely over the network, so the attacker does not need to be on the same host or LAN.
• Attack complexity: Low (AC:L): no special conditions are needed, so the attack can be repeated reliably.
• Privileges required: None (PR:N): no account or credentials are needed.
• User interaction: None (UI:N): no action by a user is required.
• Scope: Unchanged (S:U): the impact stays within the security scope of the vulnerable component.

Is there a public proof of concept or exploit?

CISA's SSVC assessment recorded in NVD (dated June 16, 2026) lists the exploitation status as "none", which means there was no evidence of active exploitation and no public proof of concept at that time. None of the references in the NVD record is tagged as an exploit. This reflects NVD and CISA records as of November 4, 2026, and public exploit code can appear at any time.

Practical exposure conditions

• Only systems that run an affected version are exposed. Compare the Perl versions in your hosts and container images against the versions listed in the Echo advisory data and the vendor advisory above.
• The vector is network-based, so Perl deployments that process input from untrusted networks carry the most risk, especially internet-facing ones. Internal-only deployments are still exposed to anyone who can reach them.
• No credentials are needed, so exposure does not depend on how well accounts are protected.
• No user has to click or open anything, so the flaw can be triggered without any user action.
• CISA's SSVC assessment marks the issue as automatable, which means exposed instances can be found and attacked at scale.

How to fix CVE-2026-12087

1. Inventory. Find every host, container image and base image that includes Perl, including the packages listed above (libperl5.40, perl, perl-base, perl-modules-5.40).
2. Upgrade. Install the Echo-built fixed package listed above for your package name.
3. Rebuild and restart. Rebuild container images and restart the services that load Perl so the patched code is actually used.
4. Verify. Re-scan your images and hosts to confirm that no package still matches a vulnerable version of CVE-2026-12087.

Interim mitigations if you cannot patch immediately

These are general hardening steps, not a vendor-specific workaround. Updating is the only complete fix.

• Restrict network access to services that use Perl to trusted sources with firewall rules or allow-lists until you can patch.
• Monitor logs and runtime behavior on affected systems for unusual activity, and prioritize them in your next patch window.

How Echo helps with CVE-2026-12087

Echo is a registered CVE Numbering Authority (CNA) and ships patched, vetted open source packages and container images, so teams can remove vulnerable components instead of tracking an endless backlog. For this CVE, Echo's advisory data tracks 4 packages (libperl5.40, perl, perl-base, perl-modules-5.40) and includes Echo-built fixed versions. Read how automated patch SLAs reduce enterprise risk in how automated patch SLAs reduce enterprise risk and why how to deal with CVE backlogs matters. Related Perl advisories: CVE-2026-57433 and CVE-2026-13221.

Frequently asked questions about CVE-2026-12087

What is CVE-2026-12087?

CVE-2026-12087 is a critical out-of-bounds read vulnerability in Perl. Perl Socket's pack_ip_mreq_source() may cause out-of-bounds reads due to improper length checks. It has a CVSS base score of 9.1.

Which versions are affected by CVE-2026-12087?

NVD does not publish structured version ranges for it yet. Echo's advisory data tracks these Perl packages: libperl5.40, perl, perl-base, perl-modules-5.40.

Is CVE-2026-12087 actively exploited?

It is not listed in CISA's KEV catalog as of November 4, 2026 (catalog version 2026.11.03), but that does not rule out exploitation. FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.57%, at the 47th percentile (November 3, 2026). On public exploit code: CISA's SSVC assessment in NVD (dated June 16, 2026) lists no public proof of concept.

How do I fix CVE-2026-12087?

Install the Echo-built fixed package listed above for your package name. Then rebuild images, restart affected services and re-scan to confirm the fix.

How severe is CVE-2026-12087?

It is rated Critical with a CVSS base score of 9.1. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H means it can be exploited over the network, with no privileges and no user interaction.

Are there other Perl vulnerabilities I should patch?

Yes. Echo's advisory data also covers CVE-2026-57433 and CVE-2026-13221. Patch them together to reduce the number of upgrade cycles.