EUVD-2026-46365
GHSA-jxx5-5g59-8f3j
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description requires a local peer with write access to the backing file, so AV:L and PR:L rather than the NVD's AV:N/PR:N; stack corruption yields high C/I/A in the reading process.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
5DescriptionCVE.org
Data::RingBuffer::Shared versions before 0.04 for Perl allow a stack buffer overflow via an unvalidated elem_size in ring_read_seq.
The attach-time validator ring_validate_header checks the capacity-overflow and total_size consistency of the header but never caps elem_size against the destination size. ring_read_seq does memcpy(out, ring_slot(h, seq), elem_size) with elem_size read raw from the mmap'd segment, copying into a fixed 8-byte destination scalar. An elem_size larger than 8 bytes writes past the destination.
A local peer that can write the backing file can leave the header valid while setting a large elem_size, so the next read copies a file-controlled length into the fixed 8-byte stack buffer, corrupting adjacent stack frames.
AnalysisAI
Stack buffer overflow in the Perl module Data::RingBuffer::Shared before 0.04 lets a local peer with write access to the shared memory backing file corrupt adjacent stack frames. The attach-time header validator (ring_validate_header) checks capacity-overflow and total_size consistency but never bounds elem_size, so ring_read_seq memcpys a file-controlled length into a fixed 8-byte destination scalar. No public exploit identified at time of analysis; EPSS is low (0.19%, 9th percentile) and it is not on CISA KEV, but the memory-corruption primitive is unambiguous and a vendor patch (0.04) exists.
Technical ContextAI
The affected component is a Perl XS/C extension (ring.h) that implements a shared-memory ring buffer over an mmap'd backing segment, letting multiple processes exchange fixed-size elements. The root cause is CWE-121 (stack-based buffer overflow): ring_read_seq performs memcpy(out, ring_slot(h, seq), elem_size) where elem_size is read raw from the untrusted mmap'd header, while the destination 'out' is a fixed 8-byte stack scalar. The validator ring_validate_header enforces capacity-overflow and total_size consistency invariants but omits the critical check that elem_size <= destination size, so any elem_size greater than 8 writes past the buffer. The CPE cpe:2.3:a:egor:data::ringbuffer::shared identifies the single affected CPAN distribution (author EGOR), reported by CPANSec and tracked as EUVD-2026-46365.
RemediationAI
Vendor-released patch: 0.04 - upgrade Data::RingBuffer::Shared to 0.04 or later (e.g. cpanm Data::RingBuffer::Shared@0.04), which adds an elem_size bound check in ring_validate_header; see https://metacpan.org/release/EGOR/Data-RingBuffer-Shared-0.04/changes . Where immediate upgrade is not possible, the effective compensating control is to remove untrusted write access to the mmap backing file: restrict filesystem permissions on the shared segment so only trusted peer processes (ideally same UID, mode 0600) can write it, and place the backing file on a non-world-writable path - the trade-off is that legitimate cross-user IPC via this ring buffer will break if it relied on broader permissions. Additionally, avoid attaching to ring segments sourced from lower-trust processes until patched. Confirm the fix by validating that reads reject headers whose elem_size exceeds the destination scalar size.
The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginni
Out-of-bounds read and write in the Perl module Data::DisjointSet::Shared before version 0.02 lets a local actor who can
Out-of-bounds memory disclosure in Data::Intern::Shared before 0.02, a Perl shared-memory string interning module, lets
Out-of-bounds read and write in the Perl module Data::SpatialHash::Shared before 0.02 lets a local peer with write acces
Entropy source compromise in Data::Entropy (Perl) before version 0.010 allows any on-path network attacker to fully cont
Out-of-bounds read in Data::RoaringBitmap::Shared before version 0.02 for Perl allows a local peer with write access to
World-readable mmap backing files and absent O_NOFOLLOW protection in Data::Buffer::Shared for Perl (versions before 0.0
Information disclosure in Data::RoaringBitmap::Shared Perl module before 0.02 allows local attackers to read sensitive I
Insecure mmap backing-file creation in Data::DisjointSet::Shared (Perl/CPAN) before 0.02 exposes inter-process IPC paylo
Information disclosure in the Perl Data::Deque::Shared module before version 0.06 exposes inter-process communication qu
World-readable IPC segment exposure in Data::SpatialHash::Shared (Perl) before version 0.02 allows any local user on a m
Insecure file creation in Data::Intern::Shared for Perl (all versions before 0.02) exposes shared memory IPC payloads to
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today