Perl CVE-2026-8376

Exploitation requires three concrete conditions: (1) the target runs a 32-bit Perl build (≤5.43.10) - 64-bit builds are not affected because SSize_t is wide enough to avoid the overflow; (2) an application compiles a regular expression whose content is attacker-controlled (e.g., user-supplied search/filter patterns passed to qr// or m//); and (3) the malicious pattern contains a quantified fixed substring with a very large minimum repeat count so that mincount × substring-byte-length overflows signed SSize_t. The trigger is at regex compile time, not match time. Limiting factors: the 32-bit-only requirement and the need for the host application to feed untrusted input into the Perl regex compiler. Although the CVSS vector is PR:N/UI:N (unauthenticated, no user interaction at the Perl level), real-world reachability depends entirely on whether the hosting application exposes regex compilation to untrusted input.

Signals here conflict sharply and should be weighed rather than taken at face value. The CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) describes a network-reachable, unauthenticated, low-complexity, high-impact flaw, but that score abstracts away two real-world gates that materially shrink the exposed population: exploitation only affects 32-bit Perl builds (64-bit builds have a wide enough SSize_t to avoid the overflow), and it requires an application that actually compiles attacker-supplied regular expressions. EPSS reflects this: 0.02% (5th percentile) indicates exploitation is assessed as very unlikely in practice. It is not in CISA KEV and no public exploit was identified at time of analysis, so this is best treated as a high-severity-but-low-immediate-likelihood issue - a genuine memory-corruption primitive worth patching on 32-bit deployments, but not an active-exploitation emergency. Note the SSVC/automatable picture is not provided in the input; the practical limiter is the 32-bit + untrusted-regex precondition, not network reachability.

An application running on a 32-bit Perl build accepts a user-supplied search pattern (for example a log-search or templating feature) and compiles it directly. An attacker submits a regular expression containing a fixed literal repeated with a very large minimum quantifier, causing mincount * length to overflow SSize_t, allocating an undersized buffer and overflowing the heap during regex compilation. The crash is reproducible (the patch removes a TODO 'This crashes' marker from the t/re/pat_psycho.t regression test), but no weaponized public exploit was identified at time of analysis.