Out-of-Bounds Read Vulnerability in Data::Intern::Shared by Perl

CVE-2026-59145

What is CVE-2026-59145?

The Data::Intern::Shared module for Perl is susceptible to an out-of-bounds read vulnerability when processing unvalidated arrays during indexing operations. Specifically, the si_idx_find function fails to validate the integrity of the slot ID, reverse offset, and arena length prefix, creating a potential for exploitation. A local attacker with write access to the backing file can manipulate the data structures, allowing them to trigger this vulnerability. The flaw can lead to the disclosure of adjacent process memory when the module processes strings derived from the tampered arena, posing a significant risk to data confidentiality.

References