CVE-2026-8376 PUBLISHED

Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds

Assigner: CPANSec
Reserved: 12.05.2026 Published: 25.05.2026 Updated: 26.05.2026

Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.

Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.

A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.

Product Status

Vendor SHAY
Product perl
Versions Default: unaffected
  • affected from 0 to 5.43.10 (incl.)

Workarounds

On 32-bit perl builds, avoid compiling regular expressions from untrusted input until a fixed release is installed.

Solutions

Upgrade to a future perl release, or apply the upstream patch.

References

Problem Types

  • CWE-680 Integer Overflow to Buffer Overflow CWE