CVE-2026-59141
A Perl module called Data::RadixTree::Shared, in versions before 0.02, has a bug that lets a local attacker read memory outside the intended bounds. The flaw occurs when the module looks up data in a shared memory file and trusts unvalidated node indices. This can expose sensitive information or crash the program.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Perl developers using the Data::RadixTree::Shared module, specifically any installation of the module older than version 0.02.
Real-world impact
An attacker who can write to the shared memory file used by the module can cause the program to read arbitrary memory, potentially leaking confidential data, or can crash the application, leading to a denial of service.
Why this severity
The CVSS score of 9.1 reflects that the vulnerability is exploitable by a local attacker with no authentication or user interaction, and it provides a high confidentiality impact by allowing arbitrary memory reads while also allowing the application to crash.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources