What is the CVSS score of CVE-2026-59141?

CVE-2026-59141 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-59141?

Within 24 hours, audit all production Perl deployments for use of Data::RadixTree::Shared module by querying CPAN dependencies and configuration management systems. Within 7 days, apply vendor patch to upgrade Data::RadixTree::Shared to version 0.02 or later on all identified systems, conduct testing in a staging environment to confirm compatibility, and document any custom modules that depend on this package. Within 30 days, complete full production rollout, validate that file permissions on shared memory-mapped backing files restrict write access to trusted processes only, and implement monitoring for unusual process crashes or memory access anomalies in RadixTree-using applications.

CVE-2026-59141

EUVD-2026-46354 CRITICAL

Out-of-bounds Read (CWE-125)

2026-07-21 9b29abf9-4ab0-4765-b253-1875cd9b441e

GHSA-hg64-92gr-322p

Buffer Overflow Information Disclosure

9.1

CVSS 3.1 · Vendor: 9b29abf9-4ab0-4765-b253-1875cd9b441e

Severity by source

Vendor (9b29abf9-4ab0-4765-b253-1875cd9b441e) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Primary rating from Vendor (9b29abf9-4ab0-4765-b253-1875cd9b441e) · only source for this CVE.

CVSS VectorVendor: 9b29abf9-4ab0-4765-b253-1875cd9b441e

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 21:09 vuln.today

CVSS changed

Jul 22, 2026 - 20:22 NVD

9.1 (CRITICAL)

Patch available

Jul 21, 2026 - 20:18 EUVD

CVE Published

Jul 21, 2026 - 19:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 21, 2026 - 19:17 cve.org

CRITICAL 9.1

DescriptionCVE.org

Data::RadixTree::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated node and arena indices in rdx_find_locked.

The attach-time validator rdx_validate_header checks the header scalars and region layout against the file size, but does not validate the node records it then trusts. rdx_find_locked indexes nodes[cur].children[k] and reads each node's label_off and label_len raw from the mmap'd segment, none bounded against the node count or the arena size.

A local peer that can write the backing file can leave the header valid while poisoning the node records, so a lookup dereferences an out-of-bounds node or arena index, reading adjacent memory or crashing the process.

AnalysisAI

Out-of-bounds read in the Data::RadixTree::Shared Perl module (all versions before 0.02) lets a local peer with write access to the shared memory-mapped backing file corrupt trusted node records and force a lookup to dereference attacker-controlled node and arena indices, leaking adjacent process memory or crashing the process. The attach-time validator rdx_validate_header checks the header and region layout but never bounds-checks the node records that rdx_find_locked subsequently trusts. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and the flaw is not in CISA KEV.