---
id: CVE-2026-57432
title: >-
  Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0
  before 5.43.11 have an integer overflow in S_measure_struct leading to an
  out-of-bounds heap read in pack and unpack.


  S_measure_struct adds each item's size tim…
summary: >-
  Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0
  before 5.43.11 have an integer overflow in S_measure_struct leading to an
  out-of-bounds heap read in pack and unpack.


  S_measure_struct adds each item's size tim…
severity: high
cvss: 8.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-125
  - CWE-190
vendor: perl
product: perl
affected:
  - perl <= 5.43.10
published: '2026-07-13'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T22:18:30.640'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-57432'
references:
  - url: >-
      https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
  - url: >-
      https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
  - url: 'http://www.openwall.com/lists/oss-security/2026/07/13/6'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-07-14T13:34:38.894921Z'
epss: 0.00196
epssPercentile: 0.08253
ingestedAt: '2026-09-08T22:12:31.038Z'
---

## Overview

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.

S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.

A template derived from untrusted input can read heap memory past the buffer and return it to the caller.

## Affected

- `perl <= 5.43.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.