Skip to main content

Perl CVE-2026-57432

HIGH
Integer Overflow or Wraparound (CWE-190)
2026-07-13 CPANSec
Buffer Overflow Integer Overflow Perl Shay
8.4
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
8.4 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.5 MEDIUM

Requires the app to build a pack/unpack template from untrusted input (uncommon, so AC:H); primitive is a read-only heap disclosure so C:H, I:N, and only possible crash gives A:L.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Red Hat
5.0 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Source Code Evidence Fetched
Jul 14, 2026 - 14:23 vuln.today
Analysis Generated
Jul 14, 2026 - 14:23 vuln.today
CVSS changed
Jul 14, 2026 - 14:22 NVD
8.4 (HIGH)
CVE Published
Jul 13, 2026 - 15:38 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 13, 2026 - 15:38 cve.org
HIGH 8.4

DescriptionNVD

Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.

S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.

A template derived from untrusted input can read heap memory past the buffer and return it to the caller.

AnalysisAI

Out-of-bounds heap read in the Perl interpreter (through version 5.43.10) lets an attacker who controls a pack or unpack template disclose adjacent heap memory back to the calling program. An unchecked integer overflow in S_measure_struct wraps the running size total negative, defeating the signed-length guards on the @, X, and x position codes and walking the buffer pointer outside its bounds. No public exploit is identified at time of analysis; the flaw was reported by CPANSec with vendor patches already committed upstream.

Technical ContextAI

The affected component is Perl's core pack/unpack machinery in pp_pack.c, which serializes and deserializes binary data according to a template string. S_measure_struct precomputes the byte size of a template by summing each item's size multiplied by its repeat count into a signed SSize_t 'total' with no overflow check - the CWE-190 (Integer Overflow or Wraparound) root cause. A sufficiently large repeat count makes len*size (or total+len*size) exceed SSize_t_MAX and wrap negative. The position codes @ (absolute seek), X (backward move) and x (forward/null move) then validate their target offset with a signed comparison that spuriously succeeds against the negative length, so the interpreter advances or rewinds the buffer pointer past the allocation and reads uninitialized/adjacent heap memory, which is returned to the Perl caller. Affected CPE is cpe:2.3:a:shay:perl:*:*:*:*:*:*:*:* (note the atypical 'shay' vendor token; the real product is Perl 5).

RemediationAI

Upgrade to a Perl release that incorporates the upstream fixes; the corrections were committed by the Perl maintainers (commits 5f7eb6bbbe0510964e3fb1d6bb691e5445913e55 and 40754edc72dd3e513d758153c0e2f0215897740e) which add an overflow check in S_measure_struct that croaks with 'Pack template structure size is too large' when len*size or total+len*size would exceed SSize_t_MAX. Because the references point to upstream commits/patches rather than a tagged release, an upstream fix is available but a specific released patched version is not independently confirmed here - track your OS/distribution's Perl package update or rebuild from a snapshot containing these commits. As a compensating control until patched, audit application code so that pack/unpack templates - and especially item repeat counts - are never constructed from untrusted input; where dynamic templates are unavoidable, clamp or validate repeat counts to sane maxima before use, accepting the trade-off of stricter input rejection. Patch details: https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch and https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch.

More in Perl

View all
CVE-2012-6329 HIGH POC
7.5 Jan 04

The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly hand
CVE-2017-12814 CRITICAL POC
9.8 Sep 28

Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before 5.24.3-RC1 and 5.26.x before
CVE-2015-8608 CRITICAL POC
9.8 Feb 07

The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of
CVE-2018-18314 CRITICAL POC
9.8 Dec 07

Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations. Rated

CVE-2018-18312 CRITICAL POC
9.8 Dec 05

Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid
CVE-2018-18313 CRITICAL POC
9.1 Dec 07

Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive informa
CVE-2016-2381 HIGH
7.5 Apr 08

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate e
CVE-2023-31484 HIGH POC
8.1 Apr 29

CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. Rated high severity (CVS
CVE-2016-6185 HIGH POC
7.8 Aug 02

The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which mig
CVE-2018-12015 HIGH POC
7.5 Jun 07

In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mecha
CVE-2015-8853 HIGH
7.5 May 25

The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-depe
CVE-2017-12883 CRITICAL
9.1 Sep 19

Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 al

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/sles/16.0/toolbox:latest Affected
openSUSE Leap 16.0 Fixed
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Server for SAP applications 16.0 Affected
SUSE Linux Micro 6.2 Affected

Share

CVE-2026-57432 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy