CVE-2026-59140

Summary

Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths.

The attach-time validator ss_validate_header bounds only the root index against the node pool (node_capacity). The order-statistics and min/max queries then follow children[], leftmost and rightmost node indices read raw from the mmap'd segment without bounding them against node_capacity. A full structural check (ss_validate_tree) exists but runs only via an explicit validate method, not on attach.

A local peer that can write the backing file can leave the header valid while poisoning the tree links, so the next rank, min or max query dereferences an out-of-bounds node index, reading adjacent memory or crashing the process.

Affected Software

VendorProductVersion RangeStatus
EGORData::SortedSet::Shared0 < 0.03affected

Weaknesses

  • CWE-125: CWE-125 Out-of-bounds Read

Workarounds

For deployments that cannot upgrade to 0.03, place the backing file in a directory writable only by the owning user, so a local peer cannot tamper with the tree the query paths traverse.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References