A stack heap buffer overflow is triggered in 32‑bit Perl builds when compiling a regular expression that contains a repeated fixed string with a large minimum count. The regex compiler calculates the required buffer size in characters rather than bytes, causing the signed size computation to overflow and resulting in a smaller allocation. The subsequent copy then writes past the end of the buffer, corrupting heap memory. The flaw can allow an attacker to overwrite critical heap data, possibly leading to arbitrary code execution or a denial‑of‑service crash.

This vulnerability affects all 32‑bit Perl installations running versions prior to 5.40.5‑RC1, any 5.41.x release before 5.42.3‑RC1, and any 5.43.x release before 5.43.11. 64‑bit builds are not known to be affected. The recommended remedy is to upgrade to Perl 5.40.5, 5.42.3, 5.44.0 or later, or to apply the upstream patch provided in the advisory.

The CVSS score of 7.3 indicates a moderate‑to‑high severity flaw, and the EPSS score of less than 1 % shows a low likelihood of current exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker can trigger the overflow by supplying a specially crafted regular expression from untrusted input to a 32‑bit Perl application, which can then lead to heap corruption and potential code execution or crash.