CVE-2026-57432 Details
Description
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.
An integer overflow vulnerability has been identified in Perl versions prior to 5.43.10, within the 'S_measure_struct' function of the 'pp_pack.c' file. This vulnerability leads to an out-of-bounds heap read during the execution of 'pack' and 'unpack' functions. The issue arises because 'S_measure_struct' calculates the size of items by multiplying their size by a repeat count, without performing an overflow check. As a result, a large repeat count can cause the total size, represented as a signed 'SSize_t', to wrap around negatively. The position codes '@', 'X', and 'x' then exploit this by advancing the buffer pointer out of bounds, potentially allowing a template based on untrusted input to read heap memory beyond the buffer limits and return it to the caller.
Users can upgrade to Perl version 5.43.10 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch | CPANSec | Patch |
| https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch | CPANSec | Patch |
| http://www.openwall.com/lists/oss-security/2026/07/13/6 | CVE | Mailing ListPatchThird Party Advisory |
Weakness Enumeration
Affected Products
| Product | Versions |
|---|---|
| perl perl | <= 5.43.10 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | CPANSec |
| Sep 8, 2026 | CVE Modified | CVE |
| Jul 14, 2026 | Initial Analysis | [email protected] |
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 13, 2026 | CVE Modified | CVE |
| Jul 13, 2026 | New CVE Received | CPANSec |