CVE-2024-56406

No indexed exploits for CVE-2024-56406 yet

A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10. When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`. $ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;' Segmentation fault (core dumped) It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.

Affected products: Alt Linux, Astra Linux, Ibm Aix, Linuxmint, Perl, Ubuntu
Perl: < 5.38.4, 5.40.2, 5.41.10

Fix: Available
CVSS 3.1: 8.4 HIGH
EPSS: 0.5% (42th percentile)
Weakness: CWE-787, CWE-122
NVD status: Modified
Published: 2025-04-13

Fix

Users should update perl to 5.40.2 or 5.38.4, or apply the upstream patch provided in the References section.

CVE-2024-56406 at NVD

Authoritative description, scoring and affected products

No exploit for CVE-2024-56406 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.