CVE-2026-57432
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
In Perl up to version 5.43.10, an integer overflow in S_measure_struct leads to an out-of-bounds heap read in pack and unpack. A large repeat count wraps the total negative, bypassing length checks and allowing reading past the buffer.
Risk Assessment
An attacker can craft a malicious template to leak heap memory, potentially exposing sensitive data like keys or user information.
Recommendation
Upgrade Perl to version 5.44.0 or later immediately. If not possible, restrict processing of untrusted pack/unpack templates.
Other vulnerabilities in Perl
See all- CVE-2016-1238High
Perl versions 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 improperly remove '.' characters from the end of the includes directory array. This may allow local users to gain privileges via a Trojan horse module under the current working directory.
- CVE-2016-2381High
Perl may allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.
- CVE-2024-56406High
A heap buffer overflow vulnerability was discovered in Perl. Affected versions include release branches 5.34, 5.36, 5.38, and 5.40, as well as development versions from 5.33.1 through 5.41.10. When non-ASCII bytes are present in the left-hand side of the `tr` operator, `S_do_trans_invmap` can overflow the buffer.
- CVE-2023-47038High
A vulnerability in Perl 5.30.0 through 5.38.0 allows a heap buffer overflow when compiling a crafted regular expression. An attacker can exploit this to cause a controlled buffer overflow.
- CVE-2026-13221Critical
In Perl versions up to 5.43.9, when compiling an alternation of more than 65535 fixed string branches into a trie in Perl_study_chunk, a 16-bit field storing the delta between the first branch and the shared tail overflows. This truncates the trie's match decision table without warning or error, causing false positive and false negative regular expression matches.
- CVE-2026-8376Critical
Perl versions up to 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. The bug in Perl_study_chunk leads to an undersized buffer allocation and subsequent out-of-bounds write.
- CVE-2015-8608Critical
The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitrary code via a crafted (1) drive letter or (2) pInName argument.
- CVE-2026-19487Medium
Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. This can lead to missed matches or matching on the wrong branch.
- CVE-2026-15534Medium
A vulnerability in Perl's regular expression engine (up to version 5.45.1) causes out-of-bounds reads and writes during pattern matching. The issue stems from an integer overflow in the superlinear cache counter, leading to undersized allocation and subsequent out-of-bounds access.
- CVE-1999-1386Medium
Perl 5.004_04 and earlier follows symbolic links when running with the -e option, allowing local users to overwrite arbitrary files via a symlink attack on the /tmp/perl-eaXXXXX file.
Original NVD description (English source)
Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.