EGOR Data::SortedSet::Shared up to 0.02 sortedset.h rank/min/max children[] out-of-bounds

Summaryinfo

A vulnerability classified as problematic has been found in EGOR Data::SortedSet::Shared up to 0.02. Impacted is the function rank/min/max of the file sortedset.h. The manipulation of the argument children[] leads to out-of-bounds. This vulnerability is listed as CVE-2026-59140. The attack must be carried out locally. There is no available exploit.

Detailsinfo

A vulnerability was found in EGOR Data::SortedSet::Shared up to 0.02. It has been rated as problematic. This issue affects the function rank/min/max of the file sortedset.h. The manipulation of the argument children[] with an unknown input leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths. The attach-time validator ss_validate_header bounds only the root index against the node pool (node_capacity). The order-statistics and min/max queries then follow children[], leftmost and rightmost node indices read raw from the mmap'd segment without bounding them against node_capacity. A full structural check (ss_validate_tree) exists but runs only via an explicit validate method, not on attach. A local peer that can write the backing file can leave the header valid while poisoning the tree links, so the next rank, min or max query dereferences an out-of-bounds node index, reading adjacent memory or crashing the process.

It is possible to read the advisory at metacpan.org. The identification of this vulnerability is CVE-2026-59140 since 07/02/2026. The exploitation is known to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 0.03 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• EGOR

Name

• Data::SortedSet::Shared

Version

• 0.02

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion