CVE-2026-57432 is an integer overflow vulnerability in Perl (SHAY project) versions up to 5.43.10. The flaw exists in the S_measure_struct function, which calculates the total size of items in pack/unpack templates by multiplying each item's size by its repeat count without checking for overflow. A large repeat count causes the signed size total to wrap negative, allowing certain position codes (@, X, x) to incorrectly advance the buffer pointer out of bounds. This results in an out-of-bounds heap read, enabling an attacker to read memory beyond the buffer when using a crafted template derived from untrusted input.

Successful exploitation allows an attacker to read heap memory beyond the intended buffer boundaries, potentially leaking sensitive information. The vulnerability has a high CVSS score (8.4) reflecting its impact on confidentiality, integrity, and availability. There is no indication of remote exploitation without local access (attack vector is local), and no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted input with pack/unpack templates that could trigger large repeat counts. Monitor vendor communications for official patches or mitigations.