Executive brief
Perl is a widely used programming language for web development, system administration, and network programming. A vulnerability in how Perl handles data formatting (the 'pack' and 'unpack' functions) could allow an attacker to read sensitive information from the computer's memory. This occurs when a program processes a specially crafted data template from an untrusted source, potentially leading to the exposure of private data or credentials.
Technical details
An integer overflow vulnerability exists in Perl's S_measure_struct function within pp_pack.c. The function fails to validate that the product of an item's size and its repeat count, when added to a running total, does not exceed the limits of a signed SSize_t. A large repeat count in a pack or unpack template can cause the total to wrap to a negative value. Subsequent position codes (@, X, and x) perform signed length comparisons that pass when the length is negative, allowing the buffer pointer to advance out of bounds. An attacker providing a malicious template can trigger an out-of-bounds heap read to leak memory contents. Patches have been developed to implement overflow checks using SSize_t_MAX.
Affected products
- Perl Foundation Perl through 5.43.10
Timeline
- 2026-07-13: disclosed
- 2026-07-13: advisory