CVE-2026-57433 is a signed integer overflow vulnerability in the HAARG Storable Perl module before version 3.41. The issue arises during deserialization of a crafted SX_HOOK record where retrieve_hook_common reads a signed 32-bit item count and adds one. If the count equals the maximum 32-bit signed integer (I32_MAX), the addition overflows and wraps to a negative value. This negative value is passed to av_extend, which causes the function to panic and terminate deserialization. This vulnerability can be triggered by passing a crafted blob to thaw or retrieve functions.

The vulnerability causes a panic and termination of the deserialization process when processing a maliciously crafted SX_HOOK record. This results in denial of service by crashing the deserialization operation. There is no information about code execution or data corruption beyond the termination of the process.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor the HAARG Storable project for an official fix in version 3.41 or later and apply updates once available. Until then, avoid deserializing untrusted data with affected versions.