CVE-2026-15534

A flaw was found in Perl. An integer overflow vulnerability in the regular expression engine's superlinear cache calculation can lead to out-of-bounds memory reads and writes. A remote attacker could exploit this by providing a specially crafted, large input string during regular expression matching. This could result in a denial of service (DoS) due to a process crash or potentially lead to heap memory corruption, enabling arbitrary code execution.

This flaw has a Moderate impact. Perl's regular expression engine contains a signed 32-bit integer overflow in the superlinear-cache size calculation (S_regmatch) that can cause out-of-bounds heap reads and writes during regex matching. Triggering it requires an application to match an attacker-controlled subject of roughly 273 MiB against a pattern containing at least 15 participating WHILEM nodes, so attack complexity is high. Successful exploitation most likely results in a process crash (denial of service); the out-of-bounds access is bit-granular into a cache bitmap, so controlled memory corruption or arbitrary code execution has not been demonstrated. Given the large, unusual inputs required and the limited reachability of the vulnerable path, Red Hat has deferred fixing this issue; residual risk is limited to a potential denial of service in applications matching very large untrusted inputs against complex patterns.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Applications can reduce exposure by limiting the size of untrusted input passed to regular-expression matching (the overflow requires a subject on the order of 273 MiB) and by avoiding matching untrusted data against highly complex patterns.