List::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in the pairwise function. pairwise() collects the values returned by the block into a heap buffer sized to the longer input array, then grows the buffer before each copy with a single quadrupling (alloc <<= 2) instead of a loop. A block call that returns more than four times the current allocation in one invocation outgrows that one quadrupling, and the copy writes past the end of the buffer. Any caller of pairwise() whose block returns, for a single pair, more than four times the longer input array's length writes past the buffer and corrupts the heap.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:2845-1 advisory.

    This update for perl-List-SomeUtils-XS fixes the following issue

    - CVE-2026-12844: heap buffer overflow in the `pairwise` function (bsc#1269210).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21218-1 advisory.

    This update for perl-List-SomeUtils-XS fixes the following issue

    - CVE-2026-12844: heap buffer overflow in the `pairwise` function (bsc#1269210).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - List::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in the pairwise function.
    pairwise() collects the values returned by the block into a heap buffer sized to the longer input array,     then grows the buffer before each copy with a single quadrupling (alloc <<= 2) instead of a loop. A block     call that returns more than four times the current allocation in one invocation outgrows that one     quadrupling, and the copy writes past the end of the buffer. Any caller of pairwise() whose block returns,     for a single pair, more than four times the longer input array's length writes past the buffer and     corrupts the heap. (CVE-2026-12844)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
326427	SUSE SLED15 / SLES15 Security Update : perl-List-SomeUtils-XS (SUSE-SU-2026:2845-1)	Nessus	SuSE Local Security Checks	high
325039	openSUSE 16 Security Update : perl-List-SomeUtils-XS (openSUSE-SU-2026:21218-1)	Nessus	SuSE Local Security Checks	high
323821	Linux Distros Unpatched Vulnerability : CVE-2026-12844	Nessus	Misc.	high

Detections

Analytics

CVE-2026-12844

high

Tenable Plugins

high

high

high