Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

CVE-2024-56406

Severity CVSS v4.0:
Pending analysis
Type:
CWE-122 Heap-based Buffer Overflow
Publication date:
13/04/2025
Last modified:
16/10/2025

Description

A heap buffer overflow vulnerability was discovered in Perl. <br /> <br /> Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10.<br /> <br /> When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`.<br /> <br />    $ perl -e &amp;#39;$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;&amp;#39; <br />    Segmentation fault (core dumped)<br /> <br /> It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.

Impact

Vector 3.x
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS v3.1 Severity and Metrics:

Base Score: 8.40 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): High
Integrity (I): High
Availability (A): High

Base Score 3.x
8.40
Severity 3.x
HIGH

Vulnerable products and versions

CPE From Up to
cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:* 5.33.1 (including) 5.38.4 (excluding)
cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:* 5.39.0 (including) 5.40.2 (excluding)
cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:* 5.41.0 (including) 5.41.10 (including)

To consult the complete list of CPE names with products and versions, see this page


References to Advisories, Solutions, and Tools