CVE-2026-8376 is a critical (9.8) heap buffer overflow in Perl when compiling a regular expression with a repeated fixed string on 32-bit builds. Perl before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, and from 5.43.0 before 5.43.11 are affected. Upgrade, and avoid compiling untrusted patterns.
What's affected
The record lists three affected ranges: Perl before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, and from 5.43.0 before 5.43.11. The record says only 32-bit builds are affected.
The upstream fix adds a check that stops the compile with a Regexp out of space error. The CPAN Security Group announcement describes the issue as present through 5.43.10. Your Linux distribution may ship backports, so read its own advisory.
How to check if you're exposed
First see whether the build is 32-bit.
perl -v | head -2
perl -V:ptrsize
A pointer size of 4 means a 32-bit build. A pointer size of 8 means this record does not apply to that interpreter. Then compare the version to the fixed ranges, and check your distribution's package changelog for a backport.
Finally, find code that compiles regular expressions built from untrusted input, for example with the qr operator on user data.
What to do now
- Inventory Perl interpreters, including those in appliances, containers and embedded devices.
- Check which are 32-bit builds using the pointer size.
- Upgrade to a fixed release, or a distribution package that carries the fix.
- Do not compile regular expressions from untrusted input, and if you must, limit the pattern length and quantifier counts.
- Confirm the interpreter version after the update.
Why it matters
The weakness is CWE-680, integer overflow to buffer overflow. The record explains that Perl_study_chunk checked the size of a joined substring buffer in characters rather than bytes. For a quantified fixed string with a large minimum count, the byte length can overflow, producing an undersized allocation and a copy that writes past its end.
The condition is narrow. It needs a 32-bit build and a caller that compiles an attacker controlled pattern. Where that is true, the effect is severe, which explains the 9.8 score. Many systems are 64-bit and unaffected, but embedded and legacy hosts often are not. The record is not listed in CISA's KEV catalog.
The 32-bit condition makes this record a good test of whether you know your estate. Most servers are 64-bit today. But Perl runs in many places that are not servers, such as network appliances, older embedded boards, build systems on legacy images and 32-bit containers. Those are exactly the places where nobody tracks the interpreter version.
A useful exercise is to search your images and appliances for perl binaries and run the pointer size check against them. Your dependency or image scanner can list perl by version, which gets you most of the way. Then narrow to those where pointer size is four.
The second condition is the input. The flaw triggers when code compiles an attacker supplied regular expression. Most Perl code compiles fixed patterns and is not exposed. Code that builds patterns from user input, such as search features or log filters that accept expressions, is. If you find such code, limiting the pattern length is a sensible control while you upgrade.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is a 64-bit Perl affected?
The record limits the issue to 32-bit builds. The upstream test notes say the problem uses too much memory to show on 64-bit systems.
Sources
Last reviewed: 19 October 2026.
