CVE-2026-57432 Integer overflow in perl:perl
An integer overflow in Perl's pack and unpack functions allows attackers to read heap memory out of bounds via crafted templates.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-57432?
CVE-2026-57432 is a high-severity vulnerability in perl:perl, published on 13 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.
S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.
A template derived from untrusted input can read heap memory past the buffer and return it to the caller.
Which versions are affected by CVE-2026-57432?
It affects 1 product.
Products include Perl Perl.
How do I fix CVE-2026-57432?
Upgrade to a fixed version.
Is CVE-2026-57432 being exploited?
There is no known exploitation of CVE-2026-57432 in the wild and no public exploit code.
Other vulnerabilities in perl:perl
Sources
Also known as AZL-92297, CLSA-2026-1784531112, CLSA-2026-1787646574, DEBIAN-CVE-2026-57432, ECHO-af51-df70-c8c4, GHSA-5g35-5jrj-f39p and 6 more.