CVE-2026-15534

Name of the Vulnerable Software and Affected Versions Perl versions prior to 5.45.2

Description Out-of-bounds heap reads and writes occur during regular expression matching due to an undersized superlinear cache in the S regmatch() function. The regex engine calculates the bit count for the superlinear cache by multiplying the subject length plus one by the number of participating WHILEM nodes. Because the system fails to check for positive overflow of the signed 32-bit count, a very large subject matched against specific patterns can result in an undersized cache allocation. Consequently, indexing the cache using the match position and node number allows reads and writes to occur beyond the allocated memory boundary, which can lead to process crashes or heap memory corruption.

Recommendations Update to version 5.45.2 or later.