CVE-2026-59145 in Data::Intern::Shared
Summary
by MITRE • 07/21/2026
Data::Intern::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated slot, reverse and arena indices in si_idx_find.
The attach-time validator si_validate_header is thorough about the header and layout (magic, version, section offsets, total_size, count and arena_used) but does not validate the three arrays it then trusts. Every lookup in si_idx_find walks a triple indirection read straight from the mmap'd segment, arena[reverse[slots[i].id]], with no bound on slots[i].id against count, on the reverse[id] arena offset against arena_used, or on the arena record's length prefix.
A local peer that can write the backing file can leave the header valid while poisoning a slot id, a reverse offset or an arena length prefix, so an id_of, intern or string lookup dereferences the chain out of bounds; because string() returns a file-controlled length of bytes from the arena, adjacent process memory can be disclosed.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/21/2026
The vulnerability in Data::Intern::Shared versions prior to 002 represents a critical out-of-bounds read flaw that stems from insufficient input validation during the attachment phase of the module's operation. This issue manifests through the si_idx_find function which performs triple indirection reads directly from memory-mapped segments without proper bounds checking on critical array indices. The si_validate_header function, while comprehensive in validating header integrity including magic numbers, version compatibility, section offsets, total size calculations, count values, and arena usage statistics, fails to validate three crucial arrays that subsequent operations trust implicitly. This validation gap creates a pathway for attackers to manipulate the internal data structures through file-based modifications.
The technical implementation of this vulnerability relies on the triple indirection chain: arena[reverse[slots[i].id]] where each level of access operates without proper boundary checks. The slots array contains id values that are not validated against the known count limit, allowing arbitrary indices to be accessed beyond the allocated slot range. Similarly, the reverse array elements which contain arena offsets are unchecked against the arena_used boundary, and the arena records themselves lack validation of their length prefixes. This complete absence of bounds checking creates multiple vectors for exploitation where a malicious actor with write access to the backing file can corrupt these arrays while maintaining header validity.
The operational impact of this vulnerability extends beyond simple memory corruption, as it enables information disclosure through controlled memory reads. When string() operations are performed on poisoned data structures, they return file-controlled byte lengths from the arena, effectively allowing adjacent process memory contents to be exposed to attackers. This disclosure can include sensitive data such as cryptographic keys, user credentials, or application state information that resides in memory adjacent to the vulnerable module. The vulnerability affects local attackers who can modify the backing file, making it particularly concerning in multi-user environments where file permissions are not properly enforced.
From a cybersecurity perspective, this vulnerability aligns with CWE-129, which addresses insufficient validation of length fields, and CWE-787, covering out-of-bounds write operations. The attack pattern follows ATT&CK technique T1059.007 for command and scripting interpreter, specifically focusing on file and directory permissions manipulation to achieve privilege escalation through memory exposure. The vulnerability also represents a classic example of the principle of least privilege violation, where internal data structures should not be directly accessible without proper validation checks. Mitigation strategies should include immediate version updates to 0.02 or later, implementation of proper bounds checking in all array access operations, and deployment of file integrity monitoring solutions to detect unauthorized modifications to shared memory segments. Additionally, system administrators should enforce strict file permissions on data files used by this module to prevent unauthorized write access that could enable exploitation of this vulnerability.