Out-of-Bounds Memory Access in Perl's Regular Expression Engine

CVE-2026-15534

What is CVE-2026-15534?

Perl versions through 5.45.1 are susceptible to out-of-bounds heap reads and writes during regular expression matching. This vulnerability arises from the engine's superlinear cache, which maintains a bit for each subject position across participating WHILEM nodes. The bit count, resulting from the subject length multiplied by the number of nodes, is not correctly validated for positive overflow, leading to potential crashes or memory corruption when processing attacker-controlled input. This risk is accentuated when dealing with large subject sizes and complex patterns, posing a significant threat to software stability.

References