CVE-2026-59141
Deferred Deferred - Pending Action

Out-of-Bounds Read in Data::RadixTree::Shared Perl Module

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: CPANSec

Description
Data::RadixTree::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated node and arena indices in rdx_find_locked. The attach-time validator rdx_validate_header checks the header scalars and region layout against the file size, but does not validate the node records it then trusts. rdx_find_locked indexes nodes[cur].children[k] and reads each node's label_off and label_len raw from the mmap'd segment, none bounded against the node count or the arena size. A local peer that can write the backing file can leave the header valid while poisoning the node records, so a lookup dereferences an out-of-bounds node or arena index, reading adjacent memory or crashing the process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-22
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-59141
EUVD
EUVD-2026-46354

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds read in the Perl module Data::RadixTree::Shared versions before 0.02. It occurs when the function rdx_find_locked accesses invalid node or arena indices without proper validation. The issue stems from unchecked node records after a header validation, allowing a local attacker who can modify the backing file to cause memory corruption or crashes.

Detection Guidance

This vulnerability involves an out-of-bounds read in Data::RadixTree::Shared Perl module versions before 0.02. Detection requires checking installed Perl module versions and examining files using the module for potential corruption or malicious node records.

Impact Analysis

If exploited, this vulnerability could allow a local attacker to read adjacent memory or crash the process running the vulnerable Perl module. This may lead to information disclosure, denial of service, or potential further exploitation depending on the application's context.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a local out-of-bounds read issue in a Perl module with no evidence of data exposure or privacy violations.

Mitigation Strategies

Immediately update Data::RadixTree::Shared to version 0.02 or later. If using a vulnerable version, restrict write access to files using the module to trusted users only. Monitor for crashes or memory corruption in processes using the module.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59141. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart