USN-8675-1: Perl vulnerabilities

unknownCVE-2026-12087 CVE-2026-13221 CVE-2026-57432 CVE-2026-57433

It was discovered that Perl incorrectly handled short source addresses in the Socket module. An attacker could possibly use this issue to trigger an out-of-bounds heap read, resulting in information disclosure. (CVE-2026-12087) It was discovered that Perl incorrectly handled regular expressions containing a large number of fixed string alternatives. An attacker could possibly use this issue to cause incorrect regular expression matches, resulting in security restrictions being bypassed. (CVE-2026-13221) It was discovered that Perl incorrectly handled certain large repeat counts when processing pack and unpack templates. An attacker could possibly use this issue to trigger an out-of-bounds heap read, resulting in information disclosure. (CVE-2026-57432) It was discovered that Perl incorrectly handled certain crafted data when deserializing with the Storable module. An attacker could possibly use this issue to trigger an integer overflow and application termination, resulting in a denial of service. (CVE-2026-57433)

CSIRTS triage

vendor: Perl product: Perl Information disclosure Memory corruption Unsafe deserializationOther

What: Perl contains multiple vulnerabilities including out-of-bounds heap reads in Socket and pack/unpack, incorrect regex matching, and unsafe deserialization in the Storable module.
Who is affected: All Perl installations using the Socket module, regular expressions with many alternatives, pack/unpack with large repeat counts, or the Storable module.
Urgency: High; multiple memory corruption and information disclosure issues affect core Perl functionality.
Action: Update Perl to the patched version provided in USN-8675-1.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Perl

Get an email when a new Perl advisory drops — max one per day, one-click unsubscribe.

Details

Source: Ubuntu Security Notices (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-08-25
Exploitation: Not in CISA KEV at last sync

Original advisory: https://ubuntu.com/security/notices/USN-8675-1

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-120870.37% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 30% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-132210.43% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 36% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-574320.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 11% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-574330.56% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 44% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-12087	coverage & exploitation status	NVD · CVE.org
CVE-2026-13221	coverage & exploitation status	NVD · CVE.org
CVE-2026-57432	coverage & exploitation status	NVD · CVE.org
CVE-2026-57433	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.