Two critical vulnerabilities affect Perl: CVE-2026-42496 (CVSS 9.1) allows arbitrary file read/write via malicious archives exploiting Archive::Tar's mishandling of symlinks, while CVE-2026-8376 (CVSS 9.8) is a heap buffer overflow in 32-bit builds triggered by compiling specific repeated regular expressions, potentially leading to code execution. The Archive::Tar module is affected in versions prior to 3.08, and Perl versions up to and including 5.43.10 are vulnerable to the heap overflow.
USN-8467-1 fixed vulnerabilities in Perl. This update provides the corresponding fix for Perl on Ubuntu 25.10. Original advisory details: It was discovered that Perl's Archive::Tar module incorrectly handled symlink and hardlink targets during extraction. An attacker could use this issue to read or overwrite arbitrary files outside the extraction directory. (CVE-2026-42496) It was discovered that Perl had a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. An attacker could use this issue to cause a denial of service or possibly execute arbitrary code. (CVE-2026-8376)