EUVD-2026-46352
GHSA-3jgv-34p5-3fxv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Description requires local write access to the shared backing file (AV:L, PR:L); out-of-bounds read leaks memory (C:H) or crashes the consumer (A:H) with no integrity impact (I:N).
Primary rating from Vendor (9b29abf9-4ab0-4765-b253-1875cd9b441e).
CVSS VectorVendor: 9b29abf9-4ab0-4765-b253-1875cd9b441e
Lifecycle Timeline
5DescriptionCVE.org
Data::ReqRep::Shared versions before 0.05 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in reqrep_recv_locked.
The attach-time validator reqrep_validate_header checks the header scalars and region layout against the file size, but does not validate the array contents it then trusts. reqrep_recv_locked does memcpy(copy_buf, req_arena + arena_off, len) with arena_off and len read raw from the mmap'd segment and never bounded against the arena capacity (req_arena_cap).
A local peer that can write the backing file can leave the header valid while poisoning a request slot's offset and length, so receiving the request copies a file-controlled offset and length out of the arena, reading adjacent memory or crashing the process.
AnalysisAI
Out-of-bounds read in the Perl module Data::ReqRep::Shared before 0.05 lets a local peer with write access to the shared mmap-backed file leak adjacent process memory or crash the process. The flaw sits in reqrep_recv_locked, which trusts an arena offset and length read straight from the shared segment without bounding them against the arena capacity. There is no public exploit identified at time of analysis, EPSS risk is low (0.16%, 5th percentile), and it is not listed in CISA KEV.
Technical ContextAI
Data::ReqRep::Shared implements a shared-memory request/reply IPC channel for Perl using an mmap'd backing file split into a header, a region layout, and a data arena. The attach-time validator reqrep_validate_header checks the header scalars and region layout against the actual file size, but it never validates the per-slot array contents it subsequently trusts. In reqrep_recv_locked, the code performs memcpy(copy_buf, req_arena + arena_off, len) where both arena_off and len are read raw from the mmap'd segment and are never checked against req_arena_cap (the arena capacity). This is a classic CWE-125 (Out-of-bounds Read): attacker-influenced offset/length values drive a copy that walks past the intended arena bounds into adjacent process memory.
RemediationAI
Vendor-released patch: 0.05 - upgrade Data::ReqRep::Shared to 0.05 or later from CPAN (cpanm Data::ReqRep::Shared), which adds bounds validation of the arena offset and length; review the fix in the 0.05 changelog and the reqrep.h diff at https://metacpan.org/release/EGOR/Data-ReqRep-Shared-0.05/changes. Where immediate upgrade is not possible, the practical compensating control is to restrict who can write the shared backing file: place it on a directory/mount that only the trusted producer process can write, tighten file ownership and permissions (e.g. 0600 owned by the service account) so no other local peer can poison a request slot, and avoid world- or group-writable shared-memory paths. The trade-off is that locking down the backing file may break legitimate multi-user or multi-service IPC setups that rely on shared write access, so validate your deployment topology before applying it. Because exploitation is local and file-mediated, standard defense such as running consumers with least privilege and monitoring the backing file for unexpected writers further reduces exposure until 0.05 is deployed.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today