Data::RoaringBitmap::Shared EUVD-2026-46364

Exploitation requires three concurrent conditions: (1) the attacker controls a local process with write permissions to the shared bitmap backing file used by the victim process - this is a same-host, same-user or same-group file write primitive, not a remote attack; (2) the victim application actively performs membership queries (rb_contains_locked calls) after the file is poisoned - the vulnerability is only triggered on query, not on attach; (3) Data::RoaringBitmap::Shared version 0.01 (pre-0.02) must be installed. What limits exploitation: the CVSS-assigned AV:N appears inconsistent with the description - the actual vector is local file access, which confines the attack to co-located processes. No network-facing exploitation path is described. The victim must also re-query the bitmap after the poisoning event, introducing a timing dependency. Remote unauthenticated exploitation is not supported by the available description or CPE data.

The assigned CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L = 6.3) contains a notable inconsistency: the description explicitly states the threat actor must be 'a local peer that can write the backing file,' which is an AV:L (local) primitive, not AV:N (network). The I:L integrity impact in the assigned vector is also unsupported - an out-of-bounds read does not confer write capability. This inflates the score relative to the actual attack surface. Correcting for local access and dropping the unsupported integrity dimension yields a materially lower real-world severity. EPSS at 0.17% (7th percentile) confirms low exploitation probability. There is no CISA KEV listing and no public proof-of-concept. The product is a niche Perl module with limited enterprise deployment. The realistic risk is LOW: exploitation requires co-location, write access to the shared file, and an active membership query, limiting the blast radius to multi-process Perl applications that specifically use shared roaring bitmaps.

An attacker controls a process running as the same user (or in the same group) as the victim Perl application and writes a crafted roaring bitmap backing file with a structurally valid header but a poisoned bucket containing an out-of-range container_off. When the victim process calls a membership query on the shared bitmap, rb_contains_locked computes pool + crafted_offset * 8192, dereferences an out-of-bounds pointer, and scans up to crafted_cardinality entries - potentially reading heap contents such as adjacent data structures or crashing with a segmentation fault. No public proof-of-concept has been identified at time of analysis.