CVE-2026-59144

Data::RingBuffer::Shared versions before 0.04 for Perl allow a stack buffer overflow via an unvalidated elem size in ring read seq.

The attach-time validator ring validate header checks the capacity-overflow and total size consistency of the header but never caps elem size against the destination size. ring read seq does memcpy(out, ring slot(h, seq), elem size) with elem size read raw from the mmap'd segment, copying into a fixed 8-byte destination scalar. An elem size larger than 8 bytes writes past the destination.

A local peer that can write the backing file can leave the header valid while setting a large elem size, so the next read copies a file-controlled length into the fixed 8-byte stack buffer, corrupting adjacent stack frames.