CVE-2026-57432

A flaw was found in Perl. An integer overflow vulnerability in the S_measure_struct function, specifically when handling pack and unpack templates with large repeat counts, can lead to an out-of-bounds heap read. This allows an attacker, by providing a specially crafted template, to read sensitive information from memory beyond the intended buffer. This could result in the disclosure of confidential data.

Red Hat is aware of this vulnerability in Perl's pack and unpack built-in functions. Exploitation requires an application to pass attacker-controlled data as a pack or unpack template, which is an uncommon programming pattern. In typical usage, templates are hardcoded in source code and not derived from untrusted input, which significantly limits the practical exploitability of this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.