Perl releases through 5.43.10 contain a heap buffer overflow that occurs when compiling regular expressions which include a repeated fixed string on 32‑bit builds. The bug arises because Perl's regex compiler calculates the required buffer size in characters, not bytes, for a quantified fixed substring with a large minimum count. Multiplying this minimum count by the substring length can overflow the signed size type, causing an undersized allocation and a subsequent memory overwrite during the compilation of the expression. An attacker who can supply a regular expression to a Perl program running on a 32‑bit build can trigger this overflow during compile time, potentially leading to arbitrary code execution or program termination.

The vulnerability affects all 32‑bit builds of Perl versions up to and including 5.43.10. No explicit statement in the CVE covers 64‑bit builds, so the vulnerability status for those builds remains undetermined.

The EPSS score is less than 1%, the CVSS score is 7.3, and the vulnerability is not listed in CISA's KEV catalog, which limits public data on how frequently it is exploited. However, buffer overflows of this nature are historically classified as high‑severity, and the fact that the overflow occurs during regex compilation gives an attacker a relatively low barrier to exploitation when untrusted input is processed. Consequently, any application that compiles user‑supplied regular expressions on a 32‑bit Perl installation is at high risk of code execution or denial of service.