Buffer overflow in Perl

CVE-2024-56406

A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10. When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`.    $ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;'    Segmentation fault (core dumped) It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.

Vulnerability class: Buffer Overflow

EPSS: 0.005 (42.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.4 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

  • Perl — versions 5.41.0, 5.39.0, 5.33.1

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2024-56406?
CVE-2024-56406 is a high-severity vulnerability in Perl, classified under Heap-based Buffer Overflow. CVSS score: 8.4/10. Published 2025-04-13.
How severe is CVE-2024-56406?
High severity. CVSS v3 base score is 8.4 out of 10.
Is CVE-2024-56406 known to be exploited?
6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.