CVE-2026-57432: 
NixOS vulnerability analysis and mitigation

CVE-2026-57432 is an integer overflow vulnerability in Perl's S_measure_struct function leading to an out-of-bounds heap read in the pack and unpack built-in functions. It affects all Perl versions through 5.43.10 and was disclosed on July 13, 2026, by the CPAN Security Group (CPANSec) via the oss-security mailing list. The fix is included in Perl 5.43.11. It carries a CVSS v3.1 base score of 8.4 (High) (GitHub Advisory, Openwall).

The root cause is a missing integer overflow check (CWE-190) in S_measure_struct within pp_pack.c, which accumulates each template item's size multiplied by its repeat count into a signed SSize_t total without bounds validation. When a maliciously large repeat count is supplied, the multiplication wraps the total to a negative value. The @, X, and x position codes in pack/unpack templates use a signed length comparison to guard buffer pointer movement; a negative total bypasses this guard, advancing the buffer pointer past the allocated heap region and triggering an out-of-bounds read (CWE-125). The fix, authored by Paul "LeoNerd" Evans, adds explicit overflow checks before accumulating len * size into the total and throws a fatal exception ("Pack template structure size is too large") if overflow is detected; a second patch also corrects potential overflows in the B/b and H/h format character length calculations (Perl5 Commit 1, Perl5 Commit 2).

Successful exploitation allows an attacker to read arbitrary heap memory from the Perl process and return it to the caller, resulting in high confidentiality impact through potential disclosure of sensitive in-memory data such as cryptographic keys, credentials, or other process secrets. The CVSS scoring also assigns high integrity and availability impact, reflecting the potential for memory corruption side effects. The attack vector is local with no privileges required, meaning any user able to supply a crafted pack/unpack template to a vulnerable Perl process — for example, through a web application, CGI script, or data processing pipeline that passes untrusted input to these functions — could trigger the vulnerability (GitHub Advisory, Openwall).

1. Identify a target: Locate a Perl application (e.g., CGI script, web service, data processing tool) running Perl ≤ 5.43.10 that passes attacker-controlled data as a pack or unpack template, or as a repeat count within a template.
2. Craft a malicious template: Construct a pack/unpack template string containing a format character (e.g., A, N, C) with an extremely large repeat count — large enough that len * size overflows a signed SSize_t and wraps to a negative value (e.g., pack("A" . (2**62) . "@0", $data)).
3. Trigger the overflow: Submit the crafted template to the target application so that S_measure_struct processes it, causing the running total to become negative.
4. Exploit position codes: Include @, X, or x position codes in the template; the negative total bypasses the signed length guard, advancing the buffer pointer out of the allocated heap region.
5. Retrieve heap memory: The unpack return value will contain bytes read from heap memory beyond the buffer, which the attacker can collect and analyze for sensitive data such as keys or credentials (Openwall, Perl5 Commit 1).

• Logs: Perl fatal error messages containing "Pack template structure size is too large" in application logs (present only on patched versions; absence on unpatched systems may indicate silent exploitation). Unexpected or malformed pack/unpack template strings in application request logs or audit trails.
• Process: Perl processes returning unusually large or binary-garbage strings from pack/unpack calls; crashes or segmentation faults in Perl processes handling template input.
• Network: For web-facing applications, HTTP requests containing oversized numeric repeat counts embedded in template parameters (e.g., parameters containing patterns like A<large_number>@).
• File System: No specific file artifacts are associated with this memory-disclosure vulnerability, as exploitation does not require writing files to disk.

The fix is included in Perl 5.43.11 (development release); users should upgrade to this version or any subsequent stable release that incorporates the patches (Openwall). Two upstream patches address the issue: one adds overflow checks in S_measure_struct before accumulating len * size, and a second corrects related overflow risks in B/b and H/h format length calculations (Perl5 Commit 1, Perl5 Commit 2). As a workaround where upgrading is not immediately possible, avoid passing untrusted input as pack/unpack templates or as repeat counts; validate and sanitize all template strings to reject excessively large numeric repeat counts before processing. Red Hat has issued an errata (RHSA-2026:39997) for affected distributions.

The vulnerability was reported to the oss-security mailing list by Stig Palmquist on behalf of the CPAN Security Group on July 13, 2026, with coordinated disclosure alongside the upstream patches (Openwall). The Perl 5.44 release, which coincided with the disclosure period, received coverage from technology outlets such as Heise and Linuxiac highlighting new language features including named function parameters, with the security fix noted in the release delta (perldelta). Microsoft acknowledged the vulnerability through its Security Response Center advisory. Community reaction on platforms such as Bluesky was limited, consistent with the low EPSS score and absence of active exploitation.