CVE-2026-59141

Name of the Vulnerable Software and Affected Versions Data::RadixTree::Shared versions prior to 0.02

Description An out-of-bounds read exists due to unvalidated node and arena indices within the rdx find locked() function. While the rdx validate header() validator checks header scalars and region layout against file size, it fails to validate node records. Consequently, rdx find locked() indexes nodes[cur].children[k] and reads label off and label len directly from the mmap'd segment without bounding them against the node count or arena size. A local attacker with write access to the backing file can poison node records to cause the lookup to dereference an out-of-bounds index, leading to the reading of adjacent memory or a process crash.

Recommendations Update to version 0.02 or later.