CVE-2026-59145
A flaw in the Perl module Data::Intern::Shared (versions before 0.02) lets an attacker read memory outside the intended data area. The bug occurs when the module trusts unvalidated indices in its internal data structures, allowing a crafted file to cause an out‑of‑bounds read. This can expose sensitive information from the process’s memory.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Perl developers using the Data::Intern::Shared module, specifically versions earlier than 0.02. The vulnerability is tied to the module’s internal handling of slot, reverse, and arena indices.
Real-world impact
An attacker who can write a malicious file that the module reads can cause the program to read arbitrary memory adjacent to the file. This can leak confidential data such as passwords, keys, or other sensitive information stored in the process’s memory.
Why this severity
The CVSS score of 9.1 reflects a network‑accessible vulnerability (AV:N) that requires no privileges (PR:N) and no user interaction (UI:N). It can compromise confidentiality (C:H) and availability (A:H) because the attacker can read memory and potentially crash the program, but it does not affect integrity (I:N).
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources