CVE-2026-15534 Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.
An attacker can trigger out-of-bounds heap reads and writes in the Perl regex engine via integer overflow, potentially causing crashes or arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-15534?
CVE-2026-15534 is a medium-severity memory corruption vulnerability in perl, published on 9 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.
The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.
A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.
Which versions are affected by CVE-2026-15534?
Linux distribution packages (40)
perl Red Hat:hummingbird:1 | All versions | 0:5.42.2-525.1.hum1 |
perl-Attribute-Handlers Red Hat:hummingbird:1 | All versions | 0:1.03-525.1.hum1 |
perl-AutoLoader Red Hat:hummingbird:1 | All versions | 0:5.74-525.1.hum1 |
perl-AutoSplit Red Hat:hummingbird:1 | All versions | 0:5.74-525.1.hum1 |
perl-B Red Hat:hummingbird:1 | All versions | 0:1.89-525.1.hum1 |
perl-Benchmark Red Hat:hummingbird:1 | All versions | 0:1.27-525.1.hum1 |
perl-Class-Struct Red Hat:hummingbird:1 | All versions | 0:0.68-525.1.hum1 |
perl-Config-Extensions Red Hat:hummingbird:1 | All versions | 0:0.03-525.1.hum1 |
perl-DBM_Filter Red Hat:hummingbird:1 | All versions | 0:0.07-525.1.hum1 |
perl-Devel-Peek Red Hat:hummingbird:1 | All versions | 0:1.36-525.1.hum1 |
perl-Devel-SelfStubber Red Hat:hummingbird:1 | All versions | 0:1.06-525.1.hum1 |
perl-DirHandle Red Hat:hummingbird:1 | All versions | 0:1.05-525.1.hum1 |
perl-Dumpvalue Red Hat:hummingbird:1 | All versions | 0:2.27-525.1.hum1 |
perl-DynaLoader Red Hat:hummingbird:1 | All versions | 0:1.57-525.1.hum1 |
perl-English Red Hat:hummingbird:1 | All versions | 0:1.11-525.1.hum1 |
perl-Errno Red Hat:hummingbird:1 | All versions | 0:1.38-525.1.hum1 |
perl-ExtUtils-Constant Red Hat:hummingbird:1 | All versions | 0:0.25-525.1.hum1 |
perl-ExtUtils-Embed Red Hat:hummingbird:1 | All versions | 0:1.35-525.1.hum1 |
perl-ExtUtils-Miniperl Red Hat:hummingbird:1 | All versions | 0:1.14-525.1.hum1 |
perl-Fcntl Red Hat:hummingbird:1 | All versions | 0:1.20-525.1.hum1 |
perl-File-Basename Red Hat:hummingbird:1 | All versions | 0:2.86-525.1.hum1 |
perl-File-Compare Red Hat:hummingbird:1 | All versions | 0:1.100.800-525.1.hum1 |
perl-File-Copy Red Hat:hummingbird:1 | All versions | 0:2.41-525.1.hum1 |
perl-File-DosGlob Red Hat:hummingbird:1 | All versions | 0:1.12-525.1.hum1 |
perl-File-Find Red Hat:hummingbird:1 | All versions | 0:1.44-525.1.hum1 |
perl-File-stat Red Hat:hummingbird:1 | All versions | 0:1.14-525.1.hum1 |
perl-FileCache Red Hat:hummingbird:1 | All versions | 0:1.10-525.1.hum1 |
perl-FileHandle Red Hat:hummingbird:1 | All versions | 0:2.05-525.1.hum1 |
perl-FindBin Red Hat:hummingbird:1 | All versions | 0:1.54-525.1.hum1 |
perl-GDBM_File Red Hat:hummingbird:1 | All versions | 0:1.24-525.1.hum1 |
perl-Getopt-Std Red Hat:hummingbird:1 | All versions | 0:1.14-525.1.hum1 |
perl-Hash-Util Red Hat:hummingbird:1 | All versions | 0:0.32-525.1.hum1 |
perl-Hash-Util-FieldHash Red Hat:hummingbird:1 | All versions | 0:1.27-525.1.hum1 |
perl-I18N-Collate Red Hat:hummingbird:1 | All versions | 0:1.02-525.1.hum1 |
perl-I18N-LangTags Red Hat:hummingbird:1 | All versions | 0:0.45-525.1.hum1 |
perl-I18N-Langinfo Red Hat:hummingbird:1 | All versions | 0:0.24-525.1.hum1 |
perl-IO Red Hat:hummingbird:1 | All versions | 0:1.55-525.1.hum1 |
perl-IPC-Open3 Red Hat:hummingbird:1 | All versions | 0:1.24-525.1.hum1 |
perl-Locale-Maketext-Simple Red Hat:hummingbird:1 | All versions | 0:0.21-525.1.hum1 |
perl-Math-Complex Red Hat:hummingbird:1 | All versions | 0:1.63-525.1.hum1 |
How do I fix CVE-2026-15534?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-15534 being exploited?
There is no known exploitation of CVE-2026-15534 in the wild and no public exploit code.
Sources
Also known as AZL-94670, DEBIAN-CVE-2026-15534, ECHO-8d4e-0265-d9a8, GHSA-2cxw-qmfc-3vx3, MINI-692f-2gqh-cqch, MINI-6fmf-8f4j-q3h5 and 6 more.