CVE-2026-15534: Perl Buffer Overflow Vulnerability

CVE-2026-15534 Overview

CVE-2026-15534 is an out-of-bounds heap read and write vulnerability in the Perl regular expression engine [CWE-125]. The flaw affects Perl versions through 5.45.1 and lives in the S_regmatch function inside regexec.c. The regex engine's superlinear cache allocates one bit per subject position for each participating WHILEM node. The cache size calculation multiplies subject length by node count without checking for signed 32-bit overflow. An attacker who supplies a controlled subject string of roughly 286,331,153 bytes matched against a pattern with 15 participating WHILEM nodes triggers integer overflow. The undersized cache is then indexed beyond its allocation, producing heap out-of-bounds reads and, on match failure, an out-of-bounds bit write via CACHEsayNO.

Critical Impact
A caller matching an attacker-controlled large subject against a crafted regex pattern can crash the Perl process or corrupt adjacent heap memory.

Affected Products

Perl versions through 5.45.1
Applications embedding the Perl regex engine and matching untrusted subjects
Downstream Perl distributions shipped by Linux vendors prior to patch backport

Discovery Timeline

2026-08-09 - Vulnerability disclosed on the OpenWall oss-security mailing list
2026-08-09 - Upstream Perl fix commits 54cf3d44 and 568e6fd2 published
2026-08-09 - CVE-2026-15534 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-15534

Vulnerability Analysis

The Perl regex engine uses a superlinear cache to prevent pathological backtracking on patterns containing WHILEM nodes. The cache is a bitmap sized as (subject_length + 1) * participating_WHILEM_nodes bits. Before the patch, S_regmatch stored this product in a signed 32-bit I32 counter named poscache_maxiter. When the multiplication exceeded I32_MAX, the result wrapped to a small positive value or overflowed the sign bit.

With a subject of 286,331,153 bytes and a pattern containing 15 participating WHILEM nodes, the true bit count is roughly 4.29 billion. The truncated 32-bit result stores 14, yielding a two-byte allocation for the cache bitmap. Subsequent cache accesses index the buffer using the real subject position and node number, driving reads well past the allocation boundary. On match failure the CACHEsayNO macro sets a bit beyond the buffer, corrupting adjacent heap metadata or data.

Root Cause

The root cause is missing overflow validation on a size computation combined with an undersized integer type [CWE-125]. The poscache_maxiter and poscache_iter fields in regexp.h were declared as I32, which cannot represent the full range of achievable products for realistic input sizes on 64-bit builds. Perl also relied on a post-hoc check for a negative wrapped value, which does not catch positive overflow into a small legitimate-looking count.

Attack Vector

Exploitation requires local input control over both the subject string and the pattern shape, or a caller that passes untrusted data of sufficient size to regexec. Because the trigger needs a subject on the order of 273 MiB, the vulnerability is primarily reachable in server processes or scripts that accept large payloads. Successful triggering produces process crashes, and heap corruption paths may permit further impact depending on allocator layout.

// Patch excerpt from regexec.c - overflow-safe cache sizing
if (!reginfo->poscache_maxiter) {
    STRLEN len = reginfo->strend - reginfo->strbeg;
    /* number of participating WHILEMs */
    U8 n = (FLAGS(scan)>>4);

    /* Only do the calculations and enable the cache if it
     * won't overflow. This test is equivalent to:
     *    ((len + 1) * n  + 7) <= max(STRLEN)
     */
    if (len < ((~(STRLEN)0) - 7)/n) {
        reginfo->poscache_maxiter = (len + 1) * n;
        reginfo->poscache_iter = reginfo->poscache_maxiter;
    }
}

Source: GitHub Perl5 Commit 54cf3d44

The fix widens poscache_maxiter and poscache_iter from I32 to STRLEN and gates cache initialization on a pre-multiplication overflow check.

Detection Methods for CVE-2026-15534

Indicators of Compromise

Perl processes terminating with SIGSEGV or SIGABRT during regex matching against large inputs
Glibc heap corruption diagnostics such as malloc(): corrupted top size or double free or corruption emitted from a Perl interpreter
Unexpected core dumps referencing S_regmatch, regexec_flags, or Perl_pregexec in stack traces

Detection Strategies

Inventory installed Perl builds and flag any interpreter reporting a version at or below 5.45.1
Audit application code for regex operations that accept untrusted subject strings larger than 200 MiB
Run fuzzing or unit tests that pass oversized subjects against patterns containing many nested WHILEM quantifiers to surface crashes in pre-production

Monitoring Recommendations

Alert on abnormal termination of long-running Perl services and web applications backed by mod_perl or FastCGI
Correlate regex-heavy service crashes with inbound request sizes above 250 MiB in web and API gateway logs
Track heap corruption signatures reported by AddressSanitizer or Electric Fence in development and staging environments

How to Mitigate CVE-2026-15534

Immediate Actions Required

Upgrade Perl to a build that includes commits 54cf3d44 and 568e6fd2 from the upstream Perl/perl5 repository
Apply distribution security updates as soon as vendors publish backported packages
Restrict the maximum size of untrusted input passed to Perl regex operations in application code

Patch Information

The upstream fix is delivered in two commits. Commit 54cf3d44 changes poscache_maxiter and poscache_iter in regexp.h from I32 to STRLEN and adds an overflow-safe guard in S_regmatch. Commit 568e6fd2 reworks the countdown so the iterator decrement no longer relies on wrap-around semantics of a signed counter. Reference the GitHub Perl5 Commit 54cf3d44 and GitHub Perl5 Commit 568e6fd2 for the full diffs. Additional context is available on the OpenWall OSS-Security Discussion.

Workarounds

Enforce an upper bound on subject string length before invoking regex matching, well below the 273 MiB trigger threshold
Reject or sanitize user-supplied regex patterns and prefer precompiled patterns authored by developers
Run Perl-based services under process isolation with automatic restart to contain crash-based denial of service

bash

# Verify installed Perl version and check for the fixed commits
perl -v
perl -e 'print $^V, "\n"'

# Rebuild Perl from source with the upstream patches applied
git clone https://github.com/Perl/perl5.git
cd perl5
git cherry-pick 54cf3d44cbbedd17d774e9a37921963e8fd5d0cb
git cherry-pick 568e6fd238867bb9e99fa3f47cba3169009239e0
./Configure -des -Dprefix=/usr/local/perl-patched
make -j$(nproc) && make test && sudo make install