CVE-2026-15534
MediumCVSS 5.7Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A vulnerability in Perl's regular expression engine (up to version 5.45.1) causes out-of-bounds reads and writes during pattern matching. The issue stems from an integer overflow in the superlinear cache counter, leading to undersized allocation and subsequent out-of-bounds access.
Risk Assessment
An attacker can cause a process crash or heap memory corruption, potentially enabling arbitrary code execution or compromising system integrity.
Recommendation
Immediately upgrade Perl to a version newer than 5.45.1 if available, and restrict processing of untrusted large inputs in regular expressions.
Other vulnerabilities in Perl
See all- CVE-2016-1238High
Perl versions 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 improperly remove '.' characters from the end of the includes directory array. This may allow local users to gain privileges via a Trojan horse module under the current working directory.
- CVE-2016-2381High
Perl may allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.
- CVE-2024-56406High
A heap buffer overflow vulnerability was discovered in Perl. Affected versions include release branches 5.34, 5.36, 5.38, and 5.40, as well as development versions from 5.33.1 through 5.41.10. When non-ASCII bytes are present in the left-hand side of the `tr` operator, `S_do_trans_invmap` can overflow the buffer.
- CVE-2023-47038High
A vulnerability in Perl 5.30.0 through 5.38.0 allows a heap buffer overflow when compiling a crafted regular expression. An attacker can exploit this to cause a controlled buffer overflow.
- CVE-2026-13221Critical
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. Overflow of a 16-bit field truncates the match decision table, leading to false positive and false negative matches.
- CVE-2026-8376Critical
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. The bug in Perl_study_chunk in regcomp_study.c checked buffer size in characters rather than bytes, leading to undersized allocation and out-of-bounds write.
- CVE-2022-48522Critical
In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation.
- CVE-2020-12723High
In Perl before 5.30.3, regcomp.c allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.
- CVE-2020-10878High
Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.
- CVE-2020-10543High
In Perl before 5.30.3 on 32-bit platforms, a heap-based buffer overflow occurs because nested regular expression quantifiers have an integer overflow.
Original NVD description (English source)
Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS