CVE-2026-8376 Details
Description
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.
A heap buffer overflow vulnerability has been identified in Perl versions prior to 5.43.10. This issue occurs when regular expressions containing repeated fixed strings are compiled on 32-bit builds. The vulnerability arises because the Perl_study_chunk function in regcomp_study.c improperly checks the size of the joined substring buffer in characters instead of bytes. For a quantified fixed substring with a large minimum count, this can lead to an integer overflow, causing an undersized memory allocation. As a result, the subsequent data copy overwrites memory beyond the allocated buffer, creating a heap buffer overflow. This vulnerability can be triggered at compile time by a caller that compiles an attacker-controlled regular expression on a 32-bit Perl build.
Users are advised to upgrade to a version of Perl that is 5.43.10 or later. Alternatively, the upstream patch can be applied.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch | CPANSec | Patch |
| http://www.openwall.com/lists/oss-security/2026/05/26/1 | CVE | Mailing ListThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-680 | Integer Overflow to Buffer Overflow | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| perl perl | <= 5.43.10 |
CPE
Remediation
| |
Change History
9 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | CVE |
| Sep 8, 2026 | CVE Modified | CPANSec |
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | Initial Analysis | [email protected] |
| May 26, 2026 | CVE Modified | CVE |
| May 26, 2026 | New CVE Received | CPANSec |