# CVE-2026-59146: Data::SpatialHash::Shared out-of-bounds read and write in sph_walk_cell and sph_alloc_slot

Source: https://junglewise.ai/threats/cve-2026-59146-data-spatialhash-shared-out-of-bounds-read-and-write-in-sph-walk  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-59146 · Severity: info · CVSS 0 · Published 2026-07-21

Data::SpatialHash::Shared is a Perl library used for managing spatial data in shared memory or files. A vulnerability in how it handles data files allows a local user with write access to the backing file to trigger memory corruption or crash the application. This could lead to a denial of service or potentially allow an attacker to gain further control over the system running the software.

Vendors: [EGOR Data](https://junglewise.ai/threats/vendors/egor-data).

## Quick answers

**Is CVE-2026-59146 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59146 being exploited in the wild.

**How severe is CVE-2026-59146?** Informational severity, with a CVSS score of 0, published 21 July 2026.

**Which products and versions are affected?** EGOR Data SpatialHash::Shared before 0.02.

**Is there a fix for CVE-2026-59146?** A patch was published on 2026-07-03: Version 0.02 released with security hardening. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59146 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-59146?** Check whether you run EGOR Data SpatialHash::Shared at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Data::SpatialHash::Shared before version 0.02 is vulnerable to out-of-bounds (OOB) reads and writes due to insufficient validation of indices stored in backing files. While the 'sph_validate_header' function checks the file size and region layout, it fails to validate the actual array contents (buckets and links) against the 'max_entries' count. A local attacker who can modify the backing file can poison the bucket chain and free list. When the library subsequently performs a query via 'sph_walk_cell' or an insertion via 'sph_alloc_slot', it follows these unvalidated indices, leading to OOB memory access, process crashes, or memory corruption. The issue is addressed in version 0.02, which also changes default file permissions to 0600.

## Affected products

- EGOR Data::SpatialHash::Shared before 0.02

## Timeline

- 2026-07-03: patched: Version 0.02 released with security hardening.
- 2026-07-21: advisory: CVE-2026-59146 published.

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://metacpan.org/release/EGOR/Data-SpatialHash-Shared-0.02/changes](https://metacpan.org/release/EGOR/Data-SpatialHash-Shared-0.02/changes)
- [https://metacpan.org/release/EGOR/Data-SpatialHash-Shared-0.02/diff/EGOR/Data-SpatialHash-Shared-0.01](https://metacpan.org/release/EGOR/Data-SpatialHash-Shared-0.02/diff/EGOR/Data-SpatialHash-Shared-0.01)