Data::RingBuffer::Shared EUVD-2026-46365

Exploitation requires the attacker to be a local peer with write access to the mmap'd backing file of the ring buffer, and a victim process that attaches to that segment and calls ring_read_seq (the read path) after the malicious header is planted. The specific trigger is a header where elem_size is set larger than the 8-byte destination scalar while capacity-overflow and total_size fields remain internally consistent, so the incomplete ring_validate_header still accepts it. Limiting factors: this is not remotely reachable despite the NVD AV:N vector - the attacker must already be able to write the shared file locally, so it is gated by filesystem permissions on the backing segment and by another process performing a read; it is not exploitable against a segment the attacker cannot write.

The signals conflict and must be reconciled. The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, score 9.8) claims unauthenticated network exploitation, but the description explicitly requires 'a local peer that can write the backing file' - i.e. local write access to the shared mmap segment, which is not a network vector and not zero-privilege. This is a material discrepancy: the real attack vector is local (AV:L) with some privilege (PR:L), so the practical severity is high but not the drive-by 9.8 the NVD vector implies - verify with vendor. Supporting this lower-real-risk read, EPSS is only 0.19% (9th percentile), there is no KEV listing, and no POC is present in the references (only upstream diff/changelog links). Technical impact is total for a process that attaches to an attacker-writable segment (stack corruption → potential code execution), but exploitation is gated by the attacker already being a co-located peer with write access to the backing file, which sharply narrows the population of realistically exploitable deployments.

An attacker who already holds a local foothold with write access to the shared ring buffer file (for example a lower-privileged co-tenant process on the same host) crafts a header that passes ring_validate_header's capacity and total_size checks but sets elem_size well above 8 bytes. When a victim process next calls ring_read_seq, the module memcpys the oversized, file-controlled data into an 8-byte stack scalar, smashing adjacent stack frames and potentially redirecting execution in the reading process. No public POC is identified at this time, and the low AC means the corruption triggers reliably once write access is obtained.