Perl Regex Engine Signed Integer Overflow Leading to Heap Out-of-Bounds
Signed 32-bit overflow in Perl's superlinear regex cache enables heap OOB read/write on attacker-controlled input. Affects Perl through 5.45.1. CVSS not yet assigned by NVD; patch commit upstream.
- Vendor
- Perl Project
- Product
- Perl (through 5.45.1)
- CVSS
- N/A
- EPSS (exploit probability)
- 0.3%
- Status
- unpatched
- Published
CVE-2026-15534 is a signed 32-bit integer overflow in Perl’s superlinear regex backtracking cache inside S_regmatch(). When the computed cache size overflows the signed integer type, the resulting allocation is drastically undersized. Subsequent writes index past the allocation, producing heap out-of-bounds reads on success paths and an OOB bit-set on failure paths.
Trigger condition: Attacker must supply a regex subject of approximately 286 MB matched against a pattern with 15 or more WHILEM nodes. This is not a low-effort attack, but any Perl application that routes externally sourced strings into regex evaluation without bounding input size is in the potential impact set — log processors, CGI handlers, API input validators, and mail parsing pipelines.
Impact per NVD: process crash or heap memory corruption. Code execution has not been confirmed.
Affected: Perl through 5.45.1. CVSS has not been assigned by NVD as of the article publication date; the severity field above reflects a conservative placeholder pending final NVD scoring — do not treat it as an authoritative rating.
Patch status: Fix commit is in the upstream perl5 repository. Distribution packages (Debian, Red Hat, Ubuntu, etc.) had not yet shipped backports as of August 9, 2026 — monitor your distribution’s security channel.
Interim mitigation: Bound input length before passing externally sourced strings to complex regex patterns. Any input exceeding a few megabytes should be rejected before reaching the regex engine.
No active exploitation has been reported.
