Executive brief
A vulnerability exists in a Perl library used for managing shared bitmap data structures. A local user with the ability to modify the data files used by this library can cause the application to crash or potentially read sensitive information from the computer's memory. This could lead to a denial of service or unauthorized access to data handled by other parts of the program.
Technical details
An out-of-bounds read vulnerability exists in the rb_contains_locked function of Data::RoaringBitmap::Shared. While the initial header validation (rb_validate_header) checks file size and layout, it fails to validate bucket contents. Specifically, rb_contains_locked calculates a container pointer using a raw, file-stored offset (pool + container_off * 8192) and iterates based on a file-stored cardinality without bounding either against the actual pool capacity. A local attacker capable of writing to the backing file can poison a bucket to trigger a wild pointer dereference or an out-of-bounds scan, leading to process crashes or memory disclosure. The issue is addressed in version 0.02.
Affected products
- EGOR Data::RoaringBitmap::Shared before 0.02
Timeline
- 2026-07-21: advisory: NVD publication date
- 2026-07-03: patched: Version 0.02 released with security hardening