Out-of-Bounds Memory Corruption in Perl Regular Expression Engine

Perl versions through 5.45.1 contain a critical memory corruption vulnerability in the regular expression engine. The issue originates within the S_regmatch function due to an undersized superlinear cache. When processing specific, maliciously crafted regular expressions, the engine may perform out-of-bounds heap reads and writes. This flaw represents a significant risk for any application utilizing Perl to process user-supplied input via regex patterns, as it could be leveraged to crash services or achieve arbitrary code execution in the context of the Perl interpreter. Organizations utilizing Perl in web applications, CGI scripts, or data processing pipelines should prioritize updating their environment to a patched version once available.

Impact

Successful exploitation of this vulnerability can lead to memory corruption, resulting in either a denial-of-service (process crash) or potential remote code execution. The impact is broad given Perl's prevalence in backend infrastructure, legacy web applications, and various system administration utilities.

Recommendation

• Upgrade all Perl distributions to a version later than 5.45.1 as soon as patches are released by the Perl community.
• Review applications that utilize Perl for processing untrusted or external input via regular expressions to identify potential exposure points.
• Audit system logs for unexpected crashes of Perl-based services which may indicate failed exploitation attempts or memory instability.