CVE-2026-8376
CRITICALDescription
Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.
Is your site exposed to CVE-2026-8376?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| perl | perl |
References
Advisories & Patches
Other References
Frequently Asked Questions
What is CVE-2026-8376? +
How severe is CVE-2026-8376? +
What products are affected by CVE-2026-8376? +
How do I check if I'm vulnerable to CVE-2026-8376? +
Related Vulnerabilities
llama.cpp is an inference of several LLM models in C/C++. Integer Overflow in the gguf_init_from_file_impl function in ggml/src/gguf.cpp can lead …
libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built without libtiff support …
An heap overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code …
Integer overflow to buffer overflow for some Intel(R) oneAPI Deep Neural Network Library (oneDNN) software before version v2026.0.0 within Ring …
A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate`. The Module Manager adds its own 16-byte private header to that …
The GUIX binary resource loader never checks that a font page's glyph range is well formed. `gx_page_header_first_glyph` and `gx_page_header_last_glyph` are …
