CVE-2026-57432Disclosure(perl / perl)

LOWCVSS 8.4 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.

perl CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

Weakness type (CWE)

CWE-125CWE-190

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

perl

Threat summary

4 mentions across 3 observed days
Momentum state: stable

What's happening

Technical details provided in 4 signals
Disclosure: 4 classified signals
Peaked 2d ago at 2 mentions (2026-07-13); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

perl

Products

perl

Deep dive

Activity timeline4 mentions / 3d

Signal classification1 categories

Disclosure

4100.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-13	2	Disclosure2
2026-07-14	1	Disclosure1
2026-07-15	1	Disclosure1

Full discourse4 posts

Open Source Security mailing list@oss_security91d
Disclosure
CVE-2026-13221: Perl through 5.43.9 may produce silently incorrect regular expression matches https://www.openwall.com/lists/oss-security/2026/07/13/5 CVE-2026-57432: Perl through 5.43.10 have an integer overflow leading to an out-of-bounds heap read in pack and unpack https://www.openwall.com/lists/oss-security/2026/07/13/6
Post summary
The post announces two new Perl vulnerabilities, outlines their technical impact, and provides links to discussion threads.
10010177
4.7K followersView on X
Windows Forum@windowsforum90d
Disclosure
🪟 Perl’s pack/unpack bug can read past heap buffers—Windows Update won’t save you. Audit Git for Windows, MSYS2, Cygwin and CI toolchains before “just a dev tool” becomes an entry point. https://windowsforum.com/threads/cve-2026-57432-update-perl-to-fix-pack-unpack-heap-memory-read.438485/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #WindowsSecurity #VulnerabilityManagement #PerlSecurity #Cve202657… https://t.co/2zW7eJ2nMF
Post summary
The tweet announces the CVE‑2026‑57432 Perl heap memory read vulnerability, urging users to audit affected tools because Windows Update will not address it.
0000031
1.2K followersView on X
Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-57432 Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item'… https://www.cve.org/CVERecord?id=CVE-2026-57432 ----- Traducción: CVE-2026-57432 Las… http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑57432, describing an integer overflow in Perl’s S_measure_struct that could cause an out‑of‑bounds heap read, without providing any PoC, exploit, patch, or evidence of active exploitation.
0000036
92 followersView on X
CVE@CVEnew91d
Disclosure
CVE-2026-57432 Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item'… https://www.cve.org/CVERecord?id=CVE-2026-57432
Post summary
The message identifies a new integer‑overflow vulnerability in Perl 5.43.10 that causes an out‑of‑bounds heap read, providing a link to the CVE record but no additional exploit or patch information.
00000728
57.8K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	perl	perl	-	-	-

Explore more

Back to dashboard perl CVEs perl vulnerabilities

What researchers are saying

CVE-2026-57432

Windows Forum[verified]@windowsforumDisclosure

The tweet announces the CVE‑2026‑57432 Perl heap memory read vulnerability, urging users to audit affected tools because Windows Update will not address it.

Open Source Security mailing list@oss_securityDisclosure

The post announces two new Perl vulnerabilities, outlines their technical impact, and provides links to discussion threads.

Infoflowcloud@infoflowcloudDisclosure

The post announces CVE‑2026‑57432, describing an integer overflow in Perl’s S_measure_struct that could cause an out‑of‑bounds heap read, without providing any PoC, exploit, patch, or evidence of active exploitation.

CVE@CVEnewDisclosure

The message identifies a new integer‑overflow vulnerability in Perl 5.43.10 that causes an out‑of‑bounds heap read, providing a link to the CVE record but no additional exploit or patch information.