Data::Intern::Shared CVE-2026-59145

Exploitation requires local write access to the module's shared memory-mapped backing file: the attacker must be a local peer able to modify that segment while leaving si_validate_header's header checks satisfied (valid magic, version, offsets, total_size, count, arena_used) and poison one of the unvalidated values - a slot id, a reverse arena offset, or an arena record length prefix. Exploitation is also gated on a victim process subsequently calling id_of, intern, or a string lookup on the tampered table, so a live consumer of the shared segment must perform a lookup after the file is poisoned. Limiting factors: no network reachability (the published AV:N is contradicted by the 'local peer that can write the backing file' requirement), the attacker needs pre-existing write permission to the file, and impact is confined to reads of adjacent memory rather than code execution or integrity loss.

The signals conflict sharply and this is the most important caveat for triage. The published CVSS 9.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, implying remote unauthenticated network exploitation, but the description explicitly requires 'a local peer that can write the backing file' - a local, authenticated-write prerequisite that is inconsistent with AV:N/PR:N. Treat the network/unauthenticated framing as unreliable; the realistic vector is local with write access to the shared segment. Supporting a lower real-world priority: EPSS is only 0.17% (7th percentile), the vulnerability is not in CISA KEV, and no public exploit code is identified. Technical impact is genuine (adjacent process memory disclosure, CWE-125) but gated behind the ability to tamper with the mmap'd file, which typically means the attacker already shares a trust boundary with the victim process. Net assessment: a legitimate confidentiality bug worth patching, but not an internet-facing, mass-exploitable emergency despite the 9.1 headline score.

A low-privileged local user who shares write access to the interning module's backing file leaves the header structurally valid but overwrites a slot id, a reverse offset, or an arena length prefix with attacker-chosen values. When a higher-privileged process using Data::Intern::Shared performs an id_of, intern, or string lookup, si_idx_find follows the poisoned arena[reverse[slots[i].id]] chain out of bounds and string() returns a file-controlled byte length from adjacent process memory, disclosing secrets to the attacker. No public exploit is identified at time of analysis, and low CVSS attack complexity means the write-and-trigger sequence is straightforward once file write access is obtained.