TI-2026-41369 Aliases CVE-2026-57432 GHSA-5g35-5jrj-f39p

Out-of-bounds read in perl

LOW 38CWE-125Published 2026-07-13 · Updated 2026-09-08

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 1 fixed, 9 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-190 and the CVSS impact.

Summary

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00211 11th percentileScored 2026-11-07

Fix Partial perl: 5.40.5-RC1, 5.42.3-RC1, 5.43.11Red Hat: 1 advisoryRed Hat: 1 fixed, 9 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	perl	before 5.40.5-RC1; 5.41.0 to before 5.42.3-RC1; 5.43.0 to before 5.43.11	5.40.5-RC1, 5.42.3-RC1, 5.43.11	Patch available	CNA

perl Vendor— Affected before 5.40.5-RC1; 5.41.0 to before 5.42.3-RC1; 5.43.0 to before 5.43.11 Fixed in 5.40.5-RC1, 5.42.3-RC1, 5.43.11 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:perl:perl::::::::	up to 5.43.10	Vulnerable	Perl

cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:* Versions up to 5.43.10 Vulnerable ·Perl

Remediation

Fix · CNA perl Fixed in 5.40.5-RC1, 5.42.3-RC1, 5.43.11

Red Hat 1 advisory

RHSA-2026:39997 Released 2026-07-15 · Red Hat rating Moderate
Red Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images perl-4:5.42.2-524.3.hum1@aarch64, perl-4:5.42.2-524.3.hum1@src, perl-4:5.42.2-524.3.hum1@x86_64 +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 6	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 7	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)	Affected	No fix yet: Fix deferred
Red Hat OpenShift Container Platform 4	Affected	No fix yet: Fix deferred
Red Hat OpenShift Container Platform 5	Affected	No fix yet: Fix deferred
Red Hat OpenShift Dev Spaces	Affected	No fix yet: Fix deferred
Red Hat Hardened Images	Fixed	RHSA-2026:39997

Timeline

2026-10-02 Threatist record created from CVE-2026-57432
2026-10-03 Alias added: GHSA-5g35-5jrj-f39p
2026-11-06 Affected versions changed · Red Hat

References

Patch 3

TI-2022-24100 In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead… CVSS 3.1CRITICAL 9.8
TI-2012-05140 The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl… CVSS 2.0HIGH 7.5
TI-2018-12932 Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular… CVSS 3.0CRITICAL 9.8
TI-2018-12931 Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular… CVSS 3.0CRITICAL 9.8
TI-2018-05049 Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows… CVSS 3.0CRITICAL 9.8
TI-2017-09493 Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl… CVSS 3.0CRITICAL 9.8

See all 45 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences