CVE-2026-59143

Received Received - Intake

Out-of-Bounds Read in Data::RoaringBitmap::Shared Perl Module

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: CPANSec

Description

Data::RoaringBitmap::Shared versions before 0.02 for Perl allow an out-of-bounds read via an unvalidated container offset and cardinality in rb_contains_locked. The attach-time validator rb_validate_header checks the header scalars and region layout against the file size, but does not validate the bucket contents it then trusts. rb_contains_locked forms a container pointer as pool + container_off * 8192 from a raw file-stored offset and then searches over a file-stored cardinality, neither bounded against the container pool capacity or the fixed 8192-byte slot size. A local peer that can write the backing file can leave the header valid while poisoning a bucket, so the next membership query dereferences a file-controlled wild pointer and scans a file-controlled count, reading adjacent memory or crashing the process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-59143

EUVD

EUVD-2026-46364

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds read issue in the Perl module Data::RoaringBitmap::Shared versions before 0.02. It occurs when the module reads a file-stored offset and cardinality without proper validation, leading to a wild pointer dereference and potential memory corruption or crashes.

Detection Guidance

This vulnerability is specific to Perl's Data::RoastingBitmap::Shared module and requires access to the module's file operations. Detection would involve inspecting Perl applications using this module for file-backed operations and validating input handling in rb_validate_header and rb_contains_locked functions.

Impact Analysis

If exploited, this vulnerability could allow a local attacker who can write to the backing file to crash the process or read adjacent memory. This may lead to information disclosure or denial of service in applications using the affected module.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level memory corruption issue in a Perl library. Compliance impacts would depend on how the affected library is used in systems handling regulated data.

Mitigation Strategies

Update Data::RoaringBitmap::Shared to version 0.02 or later. Review file permissions for Perl applications using this module to ensure only trusted users can write to backing files. Validate all file offsets and cardinalities in rb_validate_header and rb_contains_locked functions.

Hi! I’m here to help you understand CVE-2026-59143. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70