CVE-2026-15534

{"id": "CVE-2026-15534", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-15534", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-12T17:38:23.129391Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 1.4}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/Perl/perl5", "modules": ["perl"], "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "5.45.1"}], "packageURL": "pkg:cpan/perl", "packageName": "perl", "programFiles": ["regexec.c"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "S_regmatch"}]}]}], "published": "2026-08-09T18:16:42.800", "references": [{"url": "https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2026/08/09/12", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.openwall.com/lists/oss-security/2026/08/09/13", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-190"}, {"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.\n\nThe regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.\n\nA caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."}, {"lang": "es", "value": "Las versiones de Perl hasta la 5.45.1 tienen lecturas y escrituras de mont\u00f3n fuera de l\u00edmites durante la coincidencia de expresiones regulares a trav\u00e9s de una cach\u00e9 superlineal de tama\u00f1o insuficiente en S_regmatch.\n\nLa cach\u00e9 superlineal del motor de expresiones regulares contiene un bit por posici\u00f3n del sujeto para cada nodo WHILEM participante, por lo que el recuento de bits es la longitud del sujeto m\u00e1s uno multiplicado por el n\u00famero de nodos. Nada verifica ese producto para un desbordamiento positivo del recuento firmado de 32 bits: un sujeto de 286331153 bytes emparejado contra un patr\u00f3n con 15 nodos participantes almacena el recuento como 14, dejando una cach\u00e9 de dos bytes. La cach\u00e9 es entonces indexada desde la posici\u00f3n de coincidencia real y el n\u00famero de nodo, por lo que las lecturas van m\u00e1s all\u00e1 del final de la asignaci\u00f3n, y en caso de fallo CACHEsayNO establece un bit m\u00e1s all\u00e1 de ella.\n\nUn llamador que empareja un sujeto de este tama\u00f1o controlado por el atacante contra un patr\u00f3n de esta forma puede bloquear el proceso o corromper la memoria del mont\u00f3n."}], "lastModified": "2026-10-23T20:10:00.160", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}