EUVD-2026-46364
GHSA-96m7-w48r-fx74
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Local file write access is the attack primitive (AV:L, PR:L); no integrity impact from an OOB read; availability loss from potential crash.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
4DescriptionCVE.org
Data::RoaringBitmap::Shared versions before 0.02 for Perl allow an out-of-bounds read via an unvalidated container offset and cardinality in rb_contains_locked.
The attach-time validator rb_validate_header checks the header scalars and region layout against the file size, but does not validate the bucket contents it then trusts. rb_contains_locked forms a container pointer as pool + container_off * 8192 from a raw file-stored offset and then searches over a file-stored cardinality, neither bounded against the container pool capacity or the fixed 8192-byte slot size.
A local peer that can write the backing file can leave the header valid while poisoning a bucket, so the next membership query dereferences a file-controlled wild pointer and scans a file-controlled count, reading adjacent memory or crashing the process.
AnalysisAI
Out-of-bounds read in Data::RoaringBitmap::Shared before version 0.02 for Perl allows a local peer with write access to the shared backing file to redirect memory reads to arbitrary locations. The module's attach-time header validator (rb_validate_header) checks structural metadata but skips bucket content validation, so rb_contains_locked blindly trusts file-stored container offsets and cardinalities. On the next membership query, the process dereferences a fully attacker-controlled pointer and iterates over an attacker-controlled count, exposing adjacent heap or stack memory and potentially crashing the querying process. No public exploit exists and EPSS sits at 0.17% (7th percentile), indicating low real-world exploitation activity.
Technical ContextAI
Data::RoaringBitmap::Shared (CPE: cpe:2.3:a:egor:data::roaringbitmap::shared) is a Perl module implementing the Roaring Bitmap compressed bitset data structure over a shared memory-mapped backing file, enabling multiple processes to query the same bitmap concurrently. The file format stores a header and a pool of fixed 8192-byte container slots. The attach-time validator rb_validate_header verifies the header scalars (region count, file size bounds) but stops short of validating the per-bucket container_off and cardinality fields embedded in the file body. The membership query function rb_contains_locked then computes a container pointer as pool + container_off * 8192 and iterates over cardinality - both values read directly from the untrusted file - without bounding them against the actual pool allocation or the 8192-byte slot limit. CWE-125 (Out-of-Bounds Read) accurately captures the root cause: missing validation of externally sourced array indices before pointer arithmetic and memory traversal.
RemediationAI
Upgrade Data::RoaringBitmap::Shared to version 0.02 or later via CPAN (cpan install Data::RoaringBitmap::Shared or cpanm Data::RoaringBitmap::Shared). The fix in 0.02 adds bucket-level validation of container_off and cardinality against the actual pool capacity and slot size, closing the gap left by rb_validate_header. The release diff is available at https://metacpan.org/release/EGOR/Data-RoaringBitmap-Shared-0.02/diff/EGOR/Data-RoaringBitmap-Shared-0.01#roaring.h. If an immediate upgrade is not feasible, restrict filesystem permissions on the bitmap backing file so that only the owning process or a tightly controlled group can write to it - this prevents the file-poisoning prerequisite entirely. As a secondary control, audit any inter-process trust boundaries where untrusted peers share the backing file path.
The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginni
Stack buffer overflow in the Perl module Data::RingBuffer::Shared before 0.04 lets a local peer with write access to the
Out-of-bounds read and write in the Perl module Data::DisjointSet::Shared before version 0.02 lets a local actor who can
Out-of-bounds memory disclosure in Data::Intern::Shared before 0.02, a Perl shared-memory string interning module, lets
Out-of-bounds read and write in the Perl module Data::SpatialHash::Shared before 0.02 lets a local peer with write acces
Entropy source compromise in Data::Entropy (Perl) before version 0.010 allows any on-path network attacker to fully cont
World-readable mmap backing files and absent O_NOFOLLOW protection in Data::Buffer::Shared for Perl (versions before 0.0
Information disclosure in Data::RoaringBitmap::Shared Perl module before 0.02 allows local attackers to read sensitive I
Insecure mmap backing-file creation in Data::DisjointSet::Shared (Perl/CPAN) before 0.02 exposes inter-process IPC paylo
Information disclosure in the Perl Data::Deque::Shared module before version 0.06 exposes inter-process communication qu
World-readable IPC segment exposure in Data::SpatialHash::Shared (Perl) before version 0.02 allows any local user on a m
Insecure file creation in Data::Intern::Shared for Perl (all versions before 0.02) exposes shared memory IPC payloads to
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today