The flaw resides in Perl’s regular‑expression engine, where the superlinear cache used during matching is undersized and its byte count is not checked for signed‑32‑bit overflow. A crafted subject string can cause the cache to reference memory beyond its allocation, producing out‑of‑bounds reads and writes. The result is heap corruption that may crash the Perl process or, if the attacker can control the corruption pattern, lead to arbitrary code execution. The vulnerability is identified as CWE‑125, CWE‑190, and CWE‑787.

The issue affects all Perl versions up to and including 5.45.1 delivered by the LEONT vendor. Any installation running those releases that processes user‑supplied input through the regex engine is potentially susceptible.

The CVSS score of 5.7 indicates moderate severity. An EPSS score of 0.00196 indicates a very low exploitation probability, and the flaw is not listed in the CISA KEV catalog. The nature of the bug—unbounded memory accesses—still poses a significant risk if exploited. An attacker who can provide a carefully designed subject string to a Perl process (e.g., through a web application or script) can trigger the overflow and cause memory corruption. The attack requires local or remote code execution capability only if the malicious input can control the regex evaluation, which is plausible in many real‑world scenarios such as web services or command‑line utilities that accept untrusted strings.