Executive brief
Data::SpatialHash::Shared is a Perl library used for managing spatial data in shared memory or files. A vulnerability in how it handles data files allows a local user with write access to the backing file to trigger memory corruption or crash the application. This could lead to a denial of service or potentially allow an attacker to gain further control over the system running the software.
Technical details
Data::SpatialHash::Shared before version 0.02 is vulnerable to out-of-bounds (OOB) reads and writes due to insufficient validation of indices stored in backing files. While the 'sph_validate_header' function checks the file size and region layout, it fails to validate the actual array contents (buckets and links) against the 'max_entries' count. A local attacker who can modify the backing file can poison the bucket chain and free list. When the library subsequently performs a query via 'sph_walk_cell' or an insertion via 'sph_alloc_slot', it follows these unvalidated indices, leading to OOB memory access, process crashes, or memory corruption. The issue is addressed in version 0.02, which also changes default file permissions to 0600.
Affected products
- EGOR Data::SpatialHash::Shared before 0.02
Timeline
- 2026-07-03: patched: Version 0.02 released with security hardening.
- 2026-07-21: advisory: CVE-2026-59146 published.