Perl releases through 5.43.10 contain a heap buffer overflow that occurs when compiling regular expressions which include a repeated fixed string on 32‑bit builds. The bug arises because Perl's regex compiler calculates the required buffer size in characters, not bytes, for a quantified fixed substring with a large minimum count. Multiplying this minimum count by the substring length can overflow the signed size type, causing an undersized allocation and a subsequent memory overwrite during the compilation of the expression. An attacker who can supply a regular expression to a Perl program running on a 32‑bit build can trigger this overflow during compile time, potentially leading to arbitrary code execution or program termination.

The vulnerability affects all 32‑bit builds of Perl versions up to and including 5.43.10, as documented by the Perl community and noted by the SECL team. Systems running newer 64‑bit builds or later Perl releases are not affected.

The EPSS metric is not available for this entry, and the vulnerability is not listed in CISA's KEV catalog, which limits public data on how frequently it is exploited. However, buffer overflows of this nature are historically classified as high‑severity, and the fact that the overflow occurs during regex compilation gives an attacker a relatively low barrier to exploitation when untrusted input is processed. Consequently, any application that compiles user‑supplied regular expressions on a 32‑bit Perl installation is at high risk of code execution or denial of service.