CVE-2026-57433

Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch	Patch
http://www.openwall.com/lists/oss-security/2026/07/13/7	Mailing List Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nwclark:storable:*:*:*:*:*:perl:*:*

History

24 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de Storable anteriores a la 3.41 para Perl tienen un desbordamiento de entero con signo al deserializar un registro SX_HOOK manipulado. retrieve_hook_common lee un recuento de elementos con signo de 32 bits de un registro SX_HOOK y llama a av_extend con ese recuento más uno. Un recuento de I32_MAX envuelve la adición a un valor negativo. Un blob manipulado pasado a thaw o retrieve desencadena el desbordamiento; av_extend recibe el recuento negativo y termina con un pánico, finalizando la deserialización.

Information

Published : 2026-07-13 17:17

Updated : 2026-10-24 22:10

NVD link : CVE-2026-57433

Mitre link : CVE-2026-57433

CVE.ORG link : CVE-2026-57433

JSON object : View

Products Affected

nwclark

storable

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2026-57433", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57433", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-14T13:36:25.483542Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/Perl/perl5", "vendor": "HAARG", "product": "Storable", "versions": [{"status": "affected", "version": "0", "lessThan": "3.41", "versionType": "custom"}], "packageName": "Storable", "programFiles": ["Storable.xs"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "retrieve_hook_common"}]}]}], "published": "2026-07-13T17:17:55.783", "references": [{"url": "https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch", "tags": ["Patch"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/13/7", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization."}, {"lang": "es", "value": "Las versiones de Storable anteriores a la 3.41 para Perl tienen un desbordamiento de entero con signo al deserializar un registro SX_HOOK manipulado.\n\nretrieve_hook_common lee un recuento de elementos con signo de 32 bits de un registro SX_HOOK y llama a av_extend con ese recuento m\u00e1s uno. Un recuento de I32_MAX envuelve la adici\u00f3n a un valor negativo.\n\nUn blob manipulado pasado a thaw o retrieve desencadena el desbordamiento; av_extend recibe el recuento negativo y termina con un p\u00e1nico, finalizando la deserializaci\u00f3n."}], "lastModified": "2026-10-24T22:10:00.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nwclark:storable:*:*:*:*:*:perl:*:*", "vulnerable": true, "matchCriteriaId": "BD8C3506-F487-4442-A4B1-E362399DB409", "versionEndExcluding": "3.41"}], "operator": "OR"}]}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}