EUVD-2026-46367
GHSA-p5xm-h38r-4xmg
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local only (AV:L); attacker needs write access to the shared backing file, so PR:L not PR:N; a victim must query/insert to trigger it (UI:R); memory corruption gives high C/I/A.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
5DescriptionCVE.org
Data::SpatialHash::Shared versions before 0.02 for Perl allow out-of-bounds reads and writes via unvalidated bucket, link and free-list indices in sph_walk_cell and sph_alloc_slot.
The attach-time validator sph_validate_header checks the header scalars and region layout against the file size, but does not validate the array contents it then trusts. sph_walk_cell reads entries[buckets[b]] and follows each entry's next link raw, and sph_alloc_slot writes through a file-stored free_head index, none bounded against the entry count (max_entries).
A local peer that can write the backing file can leave the header valid while poisoning the bucket chain and free list, so a query reads through an out-of-bounds bucket and next index and an insert writes through an out-of-bounds free-list head, corrupting memory or crashing the process.
AnalysisAI
Out-of-bounds read and write in the Perl module Data::SpatialHash::Shared before 0.02 lets a local peer with write access to the shared backing file corrupt memory in any process that queries or inserts into the spatial hash. The attach-time validator sph_validate_header checks header scalars and region layout against file size but never validates the array contents it subsequently trusts, so poisoned bucket, next-link, and free-list indices flow unchecked into sph_walk_cell and sph_alloc_slot. No public exploit identified at time of analysis; EPSS is low (0.17%, 7th percentile) and the module is not in CISA KEV.
Technical ContextAI
The module implements a spatial hash grid persisted in a memory-mapped shared file so multiple Perl processes can share the structure. Internally (sphash.h) it stores an entries[] table, a buckets[] array of head indices, and a free_head index for slot allocation, all backed by the file. The root cause is CWE-787 (out-of-bounds write) compounded by out-of-bounds reads: sph_validate_header verifies only the scalar header fields and region offsets/sizes against the file length, establishing that the layout fits, but it does not bounds-check the contents of buckets[], the per-entry next links, or free_head against max_entries. sph_walk_cell dereferences entries[buckets[b]] and chases each entry's next pointer raw, and sph_alloc_slot writes through the file-stored free_head - none clamped to the entry count - so trusted-but-attacker-controlled indices become arbitrary array offsets. The affected CPE is cpe:2.3:a:egor:data::spatialhash::shared:*.
RemediationAI
Vendor-released patch: upgrade Data::SpatialHash::Shared to version 0.02 or later from CPAN (e.g. cpanm Data::SpatialHash::Shared), which adds bounds validation of the array contents; see the release changes at https://metacpan.org/release/EGOR/Data-SpatialHash-Shared-0.02/changes. Where immediate upgrade is not possible, the effective compensating control is to restrict write access to the shared backing file so that only trusted processes/users can modify it - place it on a filesystem path with tight ownership and permissions and avoid world- or group-writable shared directories (trade-off: legitimate multi-user sharing scenarios break if permissions are narrowed too far). Do not attach to or query backing files sourced from untrusted or lower-privileged peers, and consider running consumers under a separate low-privilege account so that any corruption is contained. Advisory URLs: https://vuldb.com/vuln/381031 and https://nvd.nist.gov/vuln/detail/CVE-2026-59146.
The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginni
Stack buffer overflow in the Perl module Data::RingBuffer::Shared before 0.04 lets a local peer with write access to the
Out-of-bounds read and write in the Perl module Data::DisjointSet::Shared before version 0.02 lets a local actor who can
Out-of-bounds memory disclosure in Data::Intern::Shared before 0.02, a Perl shared-memory string interning module, lets
Entropy source compromise in Data::Entropy (Perl) before version 0.010 allows any on-path network attacker to fully cont
Out-of-bounds read in Data::RoaringBitmap::Shared before version 0.02 for Perl allows a local peer with write access to
World-readable mmap backing files and absent O_NOFOLLOW protection in Data::Buffer::Shared for Perl (versions before 0.0
Information disclosure in Data::RoaringBitmap::Shared Perl module before 0.02 allows local attackers to read sensitive I
Insecure mmap backing-file creation in Data::DisjointSet::Shared (Perl/CPAN) before 0.02 exposes inter-process IPC paylo
Information disclosure in the Perl Data::Deque::Shared module before version 0.06 exposes inter-process communication qu
World-readable IPC segment exposure in Data::SpatialHash::Shared (Perl) before version 0.02 allows any local user on a m
Insecure file creation in Data::Intern::Shared for Perl (all versions before 0.02) exposes shared memory IPC payloads to
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today