Executive brief
A vulnerability exists in a Perl library used for managing shared data structures. A local user with access to the data's backing file can manipulate its contents to cause the application to crash or corrupt its memory when it next accesses that data. This could lead to a denial of service or potentially allow for further unauthorized actions on the system.
Technical details
The vulnerability is an out-of-bounds (OOB) read and write (CWE-125, CWE-787) in the dsu_find function of Data::DisjointSet::Shared. While the dsu_validate_header function checks the header and region layout against file size, it fails to validate the actual array contents. An attacker with write access to the backing file can poison the parent array with raw file-stored indices that exceed the node count. When dsu_find performs path compression, it uses these unvalidated indices, leading to OOB memory access. This can result in process crashes or memory corruption. The issue is fixed in version 0.02.
Affected products
- EGOR Data::DisjointSet::Shared before 0.02
Timeline
- 2026-07-03: patched: Version 0.02 released with security hardening.
- 2026-07-21: advisory: CVE-2026-59147 published.