CVE-2026-57432: Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack
Last updated 27 August 2026
Other sources
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in Smeasurestruct leading to an out-of-bounds heap read in pack and unpack.
Smeasurestruct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSizet total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.
A template derived from untrusted input can read heap memory past the buffer and return it to the caller.
— MITRE
Perl versions through 5.43.10 have an integer overflow in Smeasurestruct leading to an out-of-bounds heap read in pack and unpack
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.38.2-513 - Upgrade
Upgrade
debian/perlto a version that resolves this vulnerability.Fixed in 5.42.3-1 - Upgrade
Upgrade
Perlto a version that resolves this vulnerability.Fixed in 5.40.5-RC1 - Upgrade
Upgrade
Perlto a version that resolves this vulnerability.Fixed in 5.42.3-RC1 - Upgrade
Upgrade
Perlto a version that resolves this vulnerability.Fixed in 5.44.0 - Compensating control
If upgrading is not immediately possible, mitigate by preventing untrusted templates from being processed by Perl pack/unpack (only allow trusted inputs for pack/unpack template strings with @, X, and x position codes).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57432?
The severity of CVE-2026-57432 is rated at 57, indicating a moderate risk level.
What are the implications of CVE-2026-57432 for Perl users?
CVE-2026-57432 allows for an integer overflow leading to out-of-bounds heap read, potentially allowing malicious exploitation.
How do I fix CVE-2026-57432?
To fix CVE-2026-57432, upgrade to Perl version 5.43.11 or later which contains the necessary patches.
Which versions of Perl are affected by CVE-2026-57432?
Perl versions through 5.43.10 are affected by CVE-2026-57432.
What causes the vulnerability in CVE-2026-57432?
The vulnerability in CVE-2026-57432 is caused by an integer overflow in S_measure_struct that lacks an overflow check.