CVE-2004-2022
NVD-CWE-OtherPublished: December 31, 2004· Updated: Jun 16, 2026
Official Description
ActivePerl 5.8.x and others, and Larry Wall's Perl 5.6.1 and others, when running on Windows systems, allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long argument to the system command, which leads to a stack-based buffer overflow. NOTE: it is unclear whether this bug is in Perl or the OS API that is used by Perl.
Technical Analysis
CVE-2004-2022 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
A proof-of-concept (PoC) exploit exists for CVE-2004-2022. While not yet confirmed in active campaigns, the availability of PoC code increases exploitation risk substantially.
CVSS v3.1 Vector Breakdown
Affected Vendors & Products
Exploit & PoC Resources
All References (18)
Quick Facts
Related CVEs (NVD-CWE-Other)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2004-2022 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts