# CVE-2026-8376: Perl heap buffer overflow in regular expression compilation

Source: https://junglewise.ai/threats/cve-2026-8376-perl-heap-buffer-overflow-in-regular-expression-compilation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-26. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-8376 · Severity: info · Published 2026-05-26

Perl is a widely used programming language for web development, system administration, and network programming. A vulnerability in its regular expression engine allows an attacker to cause a memory crash or potentially execute unauthorized code by providing a specially crafted search pattern. This issue specifically affects 32-bit systems and occurs when the application processes untrusted input as a regular expression.

## Quick answers

**Is CVE-2026-8376 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8376 being exploited in the wild.

**How severe is CVE-2026-8376?** Informational severity, published 26 May 2026.

**Which products and versions are affected?** Perl Foundation Perl through 5.43.10.

**Is there a fix for CVE-2026-8376?** A patch was published on 2026-05-20: Fix merged to Perl development branch (blead) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-8376 attacked?** It is attacked over the network or with local access, in a software library.

**Am I affected by CVE-2026-8376?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap buffer overflow exists in Perl's regular expression compiler (regcomp_study.c) within the Perl_study_chunk function. The vulnerability is caused by an integer overflow (CWE-680) where the compiler calculates the size of a joined substring buffer in characters rather than bytes. On 32-bit systems, a quantified fixed substring with a large minimum count can cause the byte length calculation (mincount * l) to overflow the SSize_t type. This results in an undersized memory allocation via SvGROW, leading to a buffer overflow when the string is subsequently copied. An attacker who can provide a malicious regular expression to be compiled can trigger this overflow at compile time. A patch is available in the upstream repository.

## Affected products

- Perl Foundation Perl through 5.43.10

## Timeline

- 2026-04-24: disclosed: Issue reported to Perl maintainers
- 2026-05-20: patched: Fix merged to Perl development branch (blead)
- 2026-05-26: advisory: Public disclosure of CVE-2026-8376

## References

- [https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch](https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch)
- [http://www.openwall.com/lists/oss-security/2026/05/26/1](http://www.openwall.com/lists/oss-security/2026/05/26/1)