CVE-2026-57432: 
NixOS vulnerability analysis and mitigation

CVE-2026-57432 is an integer overflow vulnerability in Perl's S_measure_struct function that leads to an out-of-bounds heap read in the pack and unpack built-in functions. It affects all Perl versions through 5.43.10 and was disclosed on July 13, 2026, by the CPAN Security Group (CPANSec) via the oss-security mailing list. The fix is included in Perl 5.43.11. It carries a CVSS v3.1 base score of 8.4 (High) (GitHub Advisory, Openwall).

The root cause is a missing overflow check in S_measure_struct (in pp_pack.c), classified as CWE-190 (Integer Overflow or Wraparound) and CWE-125 (Out-of-bounds Read). The function accumulates each template item's size * repeat_count into a signed SSize_t total without bounds checking; a sufficiently large repeat count causes the total to wrap to a negative value. The @, X, and x position codes in pack/unpack templates use a signed length comparison to guard buffer pointer movement, which incorrectly passes when the total is negative, advancing the pointer past the end of the allocated heap buffer. Two upstream patches address this: the first adds explicit overflow detection before the accumulation step and raises a fatal exception (croak), while the second fixes additional potential overflows in the B/b and H/h format character length calculations (Perl Patch 1, Perl Patch 2).

Successful exploitation allows an unprivileged local attacker to read arbitrary heap memory beyond the intended buffer and have that data returned to the caller, resulting in high confidentiality impact. Because the out-of-bounds read can corrupt internal state or be chained with other primitives, integrity and availability are also rated High in the CVSS scoring. The primary risk is sensitive data disclosure — such as cryptographic keys, credentials, or other in-memory secrets — from the affected Perl process; lateral movement potential depends on what data the process holds in memory (GitHub Advisory, Openwall).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable. The EPSS score is approximately 0.207% (9th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Identify a target: Locate a system or application that runs Perl ≤ 5.43.10 and passes attacker-controlled data as a pack or unpack template (e.g., a web application, daemon, or script that accepts user-supplied format strings).
2. Craft a malicious template: Construct a pack/unpack template string containing a format character (e.g., A, N, C) followed by an extremely large repeat count — large enough that size * repeat_count overflows a signed SSize_t and wraps to a negative value (e.g., "A" . (2**62) . "@0").
3. Trigger the overflow: Submit the crafted template to the vulnerable Perl code path. S_measure_struct accumulates the overflowed total without detecting the wrap, resulting in a negative total.
4. Bypass bounds check: The @, X, or x position codes perform a signed comparison against the negative total, which passes incorrectly, advancing the internal buffer pointer past the end of the allocated heap region.
5. Retrieve heap data: The unpack call returns the out-of-bounds heap bytes to the caller as a Perl string, potentially exposing sensitive in-memory data such as keys, tokens, or other process secrets (Openwall, Perl Patch 1).

• Logs: Application or system logs showing Perl fatal errors such as Pack template structure size is too large (introduced by the patch) may indicate attempted exploitation against a patched system; absence of such errors on an unpatched system does not rule out exploitation.
• Process Behavior: Unexpected or anomalous output from Perl scripts that use pack/unpack, particularly binary garbage or memory-like content returned to callers or written to logs/network sockets.
• Network: If the vulnerable Perl process is network-facing, unusual binary data in HTTP responses or other protocol outputs that appears to contain heap memory artifacts (e.g., embedded pointers, strings from unrelated allocations).
• File System: Unexpected files written by Perl processes containing binary data that may represent exfiltrated heap contents.

The fix is included in Perl 5.43.11 (development release); users should upgrade to this version or any subsequent stable release that incorporates the two upstream patches (Openwall). Red Hat has issued an errata (RHSA-2026:39997) for affected RHEL packages. As a workaround, avoid passing untrusted or user-controlled data as pack/unpack templates; validate and sanitize any template strings to reject excessively large repeat counts before processing. Restricting Perl script execution to trusted sources and applying OS-level mitigations (e.g., ASLR) can reduce the practical impact until patching is possible.

The vulnerability was responsibly disclosed by Stig Palmquist on behalf of the CPAN Security Group (CPANSec) to the oss-security mailing list on July 13, 2026, with patches authored by Paul "LeoNerd" Evans (Openwall). Discussion appeared on the Perl 5 Porters mailing list in both June and July 2026, indicating the issue was tracked internally before public disclosure. Coverage was picked up by security aggregators and the Yocto Project security list, and Perl 5.44's release (which includes the fix) received broader press coverage noting the new named function parameters feature alongside the security fix (Heise).