CVE-2026-59140

Name of the Vulnerable Software and Affected Versions Data::SortedSet::Shared versions prior to 0.03

Description An out-of-bounds read exists in the rank and min/max query paths due to unvalidated node indices. The attach-time validator ss validate header() only checks the root index against the node pool node capacity. Subsequently, order-statistics and min/max queries follow children[], leftmost, and rightmost node indices read directly from the mmap'd segment without verifying them against node capacity. While a full structural check ss validate tree() is available, it is only executed via an explicit validate method and not during the attach process. A local attacker with write access to the backing file can maintain a valid header while poisoning tree links, causing subsequent rank, min, or max queries to dereference an out-of-bounds node index, which may lead to reading adjacent memory or crashing the process.

Recommendations Update Data::SortedSet::Shared to version 0.03 or later.