Is CVE-2026-59146 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59146 being exploited in the wild.

How severe is CVE-2026-59146?

Informational severity, with a CVSS score of 0, published 21 July 2026.

Which products and versions are affected?

EGOR Data SpatialHash::Shared before 0.02.

Is there a fix for CVE-2026-59146?

A patch was published on 2026-07-03: Version 0.02 released with security hardening. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59146 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-59146?

Check whether you run EGOR Data SpatialHash::Shared at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59146: Data::SpatialHash::Shared out-of-bounds read and write in sph_walk_cell and sph_alloc_slot

CVE-2026-59146 · Severity: info · CVSS 0 · Published 2026-07-21

Data::SpatialHash::Shared is a Perl library used for managing spatial data in shared memory or files. A vulnerability in how it handles data files allows a local user with write access to the backing file to trigger memory corruption or crash the application. This could lead to a denial of service or potentially allow an attacker to gain further control over the system running the software.

Vendors: EGOR Data.

Quick answers

Is CVE-2026-59146 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59146 being exploited in the wild.
How severe is CVE-2026-59146?: Informational severity, with a CVSS score of 0, published 21 July 2026.
Which products and versions are affected?: EGOR Data SpatialHash::Shared before 0.02.
Is there a fix for CVE-2026-59146?: A patch was published on 2026-07-03: Version 0.02 released with security hardening. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59146 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-59146?: Check whether you run EGOR Data SpatialHash::Shared at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Data::SpatialHash::Shared before version 0.02 is vulnerable to out-of-bounds (OOB) reads and writes due to insufficient validation of indices stored in backing files. While the 'sph_validate_header' function checks the file size and region layout, it fails to validate the actual array contents (buckets and links) against the 'max_entries' count. A local attacker who can modify the backing file can poison the bucket chain and free list. When the library subsequently performs a query via 'sph_walk_cell' or an insertion via 'sph_alloc_slot', it follows these unvalidated indices, leading to OOB memory access, process crashes, or memory corruption. The issue is addressed in version 0.02, which also changes default file permissions to 0600.

Affected products

EGOR Data::SpatialHash::Shared before 0.02

Timeline

2026-07-03: patched: Version 0.02 released with security hardening.
2026-07-21: advisory: CVE-2026-59146 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.