The flaw resides in Perl’s regular-expression engine, where the superlinear cache used during matching is undersized and its byte count is not checked for signed-32‑bit overflow. A crafted subject string can cause the cache to reference memory beyond its allocation, producing out-of-bounds reads and writes. The result is heap corruption that may crash the Perl process or, if the attacker can control the corruption pattern, lead to arbitrary code execution. The vulnerability is identified as CWE‑125, CWE‑190, and CWE‑787.

The issue affects all Perl versions up to and including 5.45.1 delivered by the LEONT vendor. Any installation running those releases that processes user-supplied input through the regex engine is potentially susceptible.

No EPSS score is available and the flaw is not listed in the CISA KEV catalog, but the nature of the bug—unbounded memory accesses—suggests a high severity if exploited. An attacker who can provide a carefully designed subject string to a Perl process (e.g., through a web application or script) can trigger the overflow and cause memory corruption. The attack requires local or remote code execution capability only if the malicious input can control the regex evaluation, which is plausible in many real-world scenarios such as web services or command-line utilities that accept untrusted strings.