Out-of-Bounds Read in Data::RoaringBitmap::Shared Affects Perl Libraries

CVE-2026-59143

What is CVE-2026-59143?

The Data::RoaringBitmap::Shared library for Perl contains a vulnerability that allows an attacker to exploit an out-of-bounds read situation. This occurs due to an unvalidated container offset and cardinality when using the rb_contains_locked function. The header validator, rb_validate_header, fails to validate the contents of the bucket, which can be manipulated by a local peer with write access to the backing file. This lack of proper validation allows crafted inputs to trigger dereferencing of unsafe pointers, potentially leading to memory corruption and process instability.

References