Perl CVE-2026-15534

Exploitation requires two simultaneous conditions beyond attacker control. First, the target application must apply a regex pattern containing at least 15 WHILEM-participating nodes - typically patterns with complex nested quantifiers such as (a+)+ or multiple alternations with repetition - to the attacker-supplied string; the vulnerability is not reachable via simple or typical regex patterns. Second, the attacker must be able to supply a subject string of approximately 286,331,153 bytes or more to that matching operation without the application enforcing an input size limit. CVSS PR:N indicates no authentication or privilege is required to supply the crafted input, while AC:H captures the specificity of the required subject size and pattern structure. Exploitation is further constrained by AV:L in the official vector, suggesting local access or a controlled input channel is assumed; network-facing applications passing unbounded user input to WHILEM-heavy patterns represent a broader exposure than this vector suggests and should be evaluated independently. The absence of confidentiality impact (C:N) means data exfiltration is not a realistic outcome - crash and heap corruption are the primary consequences.

The CVSS 3.1 vector AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H reflects local attack vector, high complexity, no required privileges, and a primary availability impact with limited integrity exposure from heap corruption. The high attack complexity (AC:H) is the most important limiting factor: triggering overflow requires simultaneously delivering a ~286MB subject string AND ensuring the regex pattern contains 15 or more WHILEM-participating nodes - a highly specific combination that will not occur in most application workflows. The EPSS score of 0.20% at the 9th percentile corroborates that observed exploitation activity is negligible, and the absence of a CISA KEV listing indicates no confirmed active exploitation. The AV:L designation in the official vector may be conservative - network-facing Perl applications that pass user input to complex regexes could present a wider attack surface, and analysts should verify the attack vector against their specific deployment. Even a mid-sized municipal IT team in rybnik running Perl-based internal tooling should treat this as a standard patch cycle priority rather than emergency remediation, given the combination of high complexity, local vector, and low EPSS. No conflicting signals are present, but the patch covers upstream commits only and no tagged release version is confirmed in available data.

An attacker identifies a Perl application that applies a complex regex pattern - one with 15 or more WHILEM-participating nodes such as deeply nested alternations or repetitions - to attacker-supplied string data without enforcing size limits. The attacker submits a payload of approximately 286MB, causing S_regmatch's cache size calculation to overflow to 14, allocating a two-byte cache, and inducing out-of-bounds memory accesses that crash the process or corrupt the heap. No public proof-of-concept code has been identified at time of analysis, and the ~286MB payload requirement presents a practical delivery obstacle.