# CVE-2026-59143: Data::RoaringBitmap::Shared out-of-bounds read in rb_contains_locked

Source: https://junglewise.ai/threats/cve-2026-59143-data-roaringbitmap-shared-out-of-bounds-read-in-rb-contains  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-59143 · Severity: info · CVSS 0 · Published 2026-07-21

A vulnerability exists in a Perl library used for managing shared bitmap data structures. A local user with the ability to modify the data files used by this library can cause the application to crash or potentially read sensitive information from the computer's memory. This could lead to a denial of service or unauthorized access to data handled by other parts of the program.

Vendors: [EGOR](https://junglewise.ai/threats/vendors/egor).

## Quick answers

**Is CVE-2026-59143 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59143 being exploited in the wild.

**How severe is CVE-2026-59143?** Informational severity, with a CVSS score of 0, published 21 July 2026.

**Which products and versions are affected?** EGOR Data::RoaringBitmap::Shared before 0.02.

**Is there a fix for CVE-2026-59143?** A patch was published on 2026-07-03: Version 0.02 released with security hardening Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59143 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-59143?** Check whether you run EGOR Data::RoaringBitmap::Shared at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read vulnerability exists in the rb_contains_locked function of Data::RoaringBitmap::Shared. While the initial header validation (rb_validate_header) checks file size and layout, it fails to validate bucket contents. Specifically, rb_contains_locked calculates a container pointer using a raw, file-stored offset (pool + container_off * 8192) and iterates based on a file-stored cardinality without bounding either against the actual pool capacity. A local attacker capable of writing to the backing file can poison a bucket to trigger a wild pointer dereference or an out-of-bounds scan, leading to process crashes or memory disclosure. The issue is addressed in version 0.02.

## Affected products

- EGOR Data::RoaringBitmap::Shared before 0.02

## Timeline

- 2026-07-21: advisory: NVD publication date
- 2026-07-03: patched: Version 0.02 released with security hardening

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://metacpan.org/release/EGOR/Data-RoaringBitmap-Shared-0.02/changes](https://metacpan.org/release/EGOR/Data-RoaringBitmap-Shared-0.02/changes)
- [https://metacpan.org/release/EGOR/Data-RoaringBitmap-Shared-0.02/diff/EGOR/Data-RoaringBitmap-Shared-0.01](https://metacpan.org/release/EGOR/Data-RoaringBitmap-Shared-0.02/diff/EGOR/Data-RoaringBitmap-Shared-0.01)