EUVD-2026-46366
GHSA-wwq3-v3pc-8w9p
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Attack is local via write access to the shared backing file (AV:L, PR:L), low complexity; primary impact is memory disclosure (C:H), possible crash on bad read (A:L), no integrity loss.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
5DescriptionCVE.org
Data::Intern::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated slot, reverse and arena indices in si_idx_find.
The attach-time validator si_validate_header is thorough about the header and layout (magic, version, section offsets, total_size, count and arena_used) but does not validate the three arrays it then trusts. Every lookup in si_idx_find walks a triple indirection read straight from the mmap'd segment, arena[reverse[slots[i].id]], with no bound on slots[i].id against count, on the reverse[id] arena offset against arena_used, or on the arena record's length prefix.
A local peer that can write the backing file can leave the header valid while poisoning a slot id, a reverse offset or an arena length prefix, so an id_of, intern or string lookup dereferences the chain out of bounds; because string() returns a file-controlled length of bytes from the arena, adjacent process memory can be disclosed.
AnalysisAI
Out-of-bounds memory disclosure in Data::Intern::Shared before 0.02, a Perl shared-memory string interning module, lets a local peer who can write the shared backing file leak adjacent process memory. The attach-time validator (si_validate_header) checks header magic, version, offsets, total_size and counts but never bounds-checks the slot, reverse, and arena arrays it subsequently trusts, so a poisoned index in si_idx_find drives a triple-indirection read past valid bounds. No public exploit is identified at time of analysis and EPSS risk is low (0.17%), but a vendor patch (0.02) is available.
Technical ContextAI
The module implements a memory-mapped, shared string-interning table in C (intern.h) where lookups resolve a string through a triple indirection: arena[reverse[slots[i].id]]. The root cause is CWE-125 (Out-of-bounds Read): si_validate_header thoroughly validates the fixed header and layout (magic, version, section offsets, total_size, count, arena_used) but performs no validation of the three variable-length arrays it then relies on. Consequently si_idx_find never bounds slots[i].id against count, never checks the reverse[id] arena offset against arena_used, and never validates the arena record's length prefix. Because string() returns a file-controlled length of bytes from the arena, an attacker who controls those on-disk values dictates both the read location and the number of bytes returned. The affected package is identified by CPE cpe:2.3:a:egor:data::intern::shared covering all versions before 0.02.
RemediationAI
Vendor-released patch: upgrade Data::Intern::Shared to 0.02 or later from CPAN, which adds validation of the slot, reverse, and arena arrays that 0.01 trusted (see the 0.01-to-0.02 intern.h diff and changes file on MetaCPAN). Until upgrading, the practical compensating control is to protect the shared backing file: ensure only the owning process and trusted principals have write permission to the mmap'd segment (restrictive filesystem permissions/ownership and, where possible, a private or per-user directory), since the entire attack depends on a local peer writing poisoned indices into that file. Avoid placing the backing file in world- or group-writable locations such as shared temp directories, and verify no untrusted local account can open it for writing; the trade-off is purely operational tightening with no functional loss. Do not rely on the header being valid as a defense, because the header can be left valid while the arrays are poisoned.
The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginni
Stack buffer overflow in the Perl module Data::RingBuffer::Shared before 0.04 lets a local peer with write access to the
Out-of-bounds read and write in the Perl module Data::DisjointSet::Shared before version 0.02 lets a local actor who can
Out-of-bounds read and write in the Perl module Data::SpatialHash::Shared before 0.02 lets a local peer with write acces
Entropy source compromise in Data::Entropy (Perl) before version 0.010 allows any on-path network attacker to fully cont
Out-of-bounds read in Data::RoaringBitmap::Shared before version 0.02 for Perl allows a local peer with write access to
World-readable mmap backing files and absent O_NOFOLLOW protection in Data::Buffer::Shared for Perl (versions before 0.0
Information disclosure in Data::RoaringBitmap::Shared Perl module before 0.02 allows local attackers to read sensitive I
Insecure mmap backing-file creation in Data::DisjointSet::Shared (Perl/CPAN) before 0.02 exposes inter-process IPC paylo
Information disclosure in the Perl Data::Deque::Shared module before version 0.06 exposes inter-process communication qu
World-readable IPC segment exposure in Data::SpatialHash::Shared (Perl) before version 0.02 allows any local user on a m
Insecure file creation in Data::Intern::Shared for Perl (all versions before 0.02) exposes shared memory IPC payloads to
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today