CVE-2026-57432
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.
Risk Assessment
An attacker can exploit this vulnerability to read data from heap memory, potentially leading to disclosure of sensitive information or further privilege escalation. The vulnerability can be exploited remotely if untrusted input is processed by pack/unpack functions.
Recommendation
It is recommended to upgrade Perl to a patched version (5.40.5-RC1, 5.42.3-RC1, 5.43.11 or later). Also, avoid processing untrusted pack/unpack templates.
Other vulnerabilities in Perl
See all- CVE-2016-1238High
Perl versions 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 improperly remove '.' characters from the end of the includes directory array. This may allow local users to gain privileges via a Trojan horse module under the current working directory.
- CVE-2016-2381High
Perl may allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.
- CVE-2024-56406High
A heap buffer overflow vulnerability was discovered in Perl. Affected versions include release branches 5.34, 5.36, 5.38, and 5.40, as well as development versions from 5.33.1 through 5.41.10. When non-ASCII bytes are present in the left-hand side of the `tr` operator, `S_do_trans_invmap` can overflow the buffer.
- CVE-2023-47038High
A vulnerability in Perl 5.30.0 through 5.38.0 allows a heap buffer overflow when compiling a crafted regular expression. An attacker can exploit this to cause a controlled buffer overflow.
- CVE-2026-13221Critical
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. Overflow of a 16-bit field truncates the match decision table, leading to false positive and false negative matches.
- CVE-2026-8376Critical
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. The bug in Perl_study_chunk in regcomp_study.c checked buffer size in characters rather than bytes, leading to undersized allocation and out-of-bounds write.
- CVE-2022-48522Critical
In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation.
- CVE-2020-12723High
In Perl before 5.30.3, regcomp.c allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.
- CVE-2020-10878High
Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.
- CVE-2020-10543High
In Perl before 5.30.3 on 32-bit platforms, a heap-based buffer overflow occurs because nested regular expression quantifiers have an integer overflow.
Original NVD description (English source)
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS