CRITICAL 9.8 Microsoft

CVE-2026-4176

Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib

Microsoft Security Update 2026-Mar: Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib

Affected Products

cbl2 binutils 2.37-20 on CBL Mariner 2.0
cbl2 boost 1.76.0-4 on CBL Mariner 2.0
cbl2 ceph 16.2.10-11 on CBL Mariner 2.0
cbl2 cloud-hypervisor 32.0-7 on CBL Mariner 2.0
cbl2 cloud-hypervisor-cvm 38.0.72.2-5 on CBL Mariner 2.0
cbl2 crash 8.0.1-5 on CBL Mariner 2.0
azl3 binutils 2.41-10 on Azure Linux 3.0
cbl2 erlang 25.3.2.21-5 on CBL Mariner 2.0

References

Published: 2026-03-10 · Source: Microsoft · Feed updated: 2026-08-10

This critical severity vulnerability with a CVSS score of 9.8 was published on 2026-03-10 via Microsoft. Affected: cbl2 binutils 2.37-20 on CBL Mariner 2.0, cbl2 boost 1.76.0-4 on CBL Mariner 2.0, cbl2 ceph 16.2.10-11 on CBL Mariner 2.0 and 5 more.

Risk Timeline

CVE Disclosed2026-03-10 · 152 days ago

Remediation Resources

Official Advisory

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-4176

NVD / MITRE

nvd.nist.gov/vuln/detail/CVE-2026-4176

Related Vulnerabilities

CVE	Title	Severity	CVSS
CVE-2025-49844 PoC	Redis Lua Use-After-Free may lead to remote code execution	CRITICAL	9.9
CVE-2024-36048	QAbstractOAuth in Qt Network Authorization in Qt before 5.15.17, 6.x before 6.2.	CRITICAL	9.8
CVE-2026-33937	Handlebars.js has JavaScript Injection via AST Type Confusion	CRITICAL	9.8
CVE-2026-3381	Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure ver	CRITICAL	9.8
CVE-2025-68615	Net-SNMP snmptrapd crash	CRITICAL	9.8
CVE-2025-0665	eventfd double close	CRITICAL	9.8

vulnfeed aggregates 8893 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.