CVE-2026-57432
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.
Risk Assessment
An attacker can exploit this vulnerability to read data from heap memory, potentially leading to disclosure of sensitive information or further privilege escalation. The vulnerability can be exploited remotely if untrusted input is processed by pack/unpack functions.
Recommendation
It is recommended to upgrade Perl to a patched version (5.40.5-RC1, 5.42.3-RC1, 5.43.11 or later). Also, avoid processing untrusted pack/unpack templates.
Other vulnerabilities in Perl
See all- CVE-2016-1238High
Perl versions 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 improperly remove '.' characters from the end of the includes directory array. This may allow local users to gain privileges via a Trojan horse module under the current working directory.
- CVE-2016-2381High
Perl may allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.
- CVE-2024-56406High
A heap buffer overflow vulnerability was discovered in Perl. Affected versions include release branches 5.34, 5.36, 5.38, and 5.40, as well as development versions from 5.33.1 through 5.41.10. When non-ASCII bytes are present in the left-hand side of the `tr` operator, `S_do_trans_invmap` can overflow the buffer.
- CVE-2023-47038High
A vulnerability in Perl 5.30.0 through 5.38.0 allows a heap buffer overflow when compiling a crafted regular expression. An attacker can exploit this to cause a controlled buffer overflow.
- CVE-2026-13221Critical
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. Overflow of a 16-bit field truncates the match decision table, leading to false positive and false negative matches.
- CVE-2026-8376Critical
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. The bug in Perl_study_chunk in regcomp_study.c checked buffer size in characters rather than bytes, leading to undersized allocation and out-of-bounds write.
- CVE-2015-8608Critical
The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitrary code via a crafted (1) drive letter or (2) pInName argument.
- CVE-2026-19487Medium
Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. This can lead to missed matches or matching on the wrong branch.
- CVE-2026-15534Medium
A vulnerability in Perl's regular expression engine (up to version 5.45.1) causes out-of-bounds reads and writes during pattern matching. The issue stems from an integer overflow in the superlinear cache counter, leading to undersized allocation and subsequent out-of-bounds access.
- CVE-1999-1386Medium
Perl 5.004_04 and earlier follows symbolic links when running with the -e option, allowing local users to overwrite arbitrary files via a symlink attack on the /tmp/perl-eaXXXXX file.
Original NVD description (English source)
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS