CVE-2026-59141: Perl Data::RadixTree Buffer Overflow Flaw

CVE-2026-59141 Overview

CVE-2026-59141 is an out-of-bounds read vulnerability in the Perl module Data::RadixTree::Shared before version 0.02. The flaw resides in the rdx_find_locked function, which trusts node records from an mmap'd backing file without validating indices against the node count or arena size. A local peer with write access to the backing file can poison node records while keeping the header valid, causing lookups to dereference out-of-bounds node or arena indices. The result is disclosure of adjacent memory or a process crash. The issue is tracked as CWE-125 (Out-of-bounds Read).

Critical Impact
An attacker who can write the shared backing file can trigger out-of-bounds memory reads in any process performing radix tree lookups, leading to information disclosure or denial of service.

Affected Products

Data::RadixTree::Shared for Perl versions before 0.02
Perl applications consuming shared radix tree files produced by untrusted local peers
Multi-process deployments sharing an mmap'd radix tree backing file

Discovery Timeline

2026-07-21 - CVE-2026-59141 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-59141

Vulnerability Analysis

The vulnerability affects Data::RadixTree::Shared, a Perl module implementing a shared-memory radix tree backed by a memory-mapped file. The module exposes a lookup path through rdx_find_locked, which walks nodes indexed from the shared arena. On attach, the module invokes rdx_validate_header to check header scalars and confirm the region layout matches the file size. That validator does not inspect the node records the lookup path later depends on.

During lookup, rdx_find_locked reads nodes[cur].children[k] and each node's label_off and label_len fields directly from mapped memory. None of these values are bounded against the declared node count or arena size. A local peer with write access to the backing file can leave the header intact while corrupting node records, steering the walk to arbitrary memory offsets.

Root Cause

The root cause is missing bounds validation on data crossing a trust boundary. The header validator establishes structural integrity of fixed fields but does not extend that scrutiny to node arrays. Because the shared file is treated as trusted after rdx_validate_header succeeds, subsequent reads of children[k], label_off, and label_len are used as offsets without sanity checks. Any writer of the shared file becomes an implicit code-adjacent authority over the reader's address space.

Attack Vector

Exploitation requires the ability to write the backing file consumed by another process using Data::RadixTree::Shared. The attacker crafts a file with a well-formed header that passes rdx_validate_header and node records whose child indices or label offsets point outside the arena. When the victim process performs a lookup, rdx_find_locked dereferences the poisoned indices. The consequence is either disclosure of adjacent process memory through the returned label bytes or a segmentation fault crashing the reader.

See the MetaCPAN Diff Comparison for the source-level changes that add the missing bounds checks.

Detection Methods for CVE-2026-59141

Indicators of Compromise

Unexpected segmentation faults or SIGSEGV core dumps in Perl processes linking Data::RadixTree::Shared
Modifications to shared radix tree backing files by processes outside the expected producer identity
Anomalous read patterns from mmap'd radix tree files where offsets exceed the declared arena size

Detection Strategies

Inventory installed Perl modules and flag any host with Data::RadixTree::Shared at a version lower than 0.02
Monitor file integrity on shared radix tree files and alert on writes from unauthorized user identities
Instrument Perl workers with crash telemetry and correlate faults with recent backing file changes

Monitoring Recommendations

Enable auditd or equivalent file access logging on directories that hold shared radix tree files
Track process crash rates for services using the module and investigate spikes tied to file modification events
Review CPAN dependency manifests during CI to prevent regressions to Data-RadixTree-Shared-0.01

How to Mitigate CVE-2026-59141

Immediate Actions Required

Upgrade Data::RadixTree::Shared to version 0.02 or later on all systems
Restrict write permissions on radix tree backing files to a single trusted producer account
Audit local user accounts and services that share filesystem access with consumers of the module

Patch Information

Version 0.02 of Data::RadixTree::Shared introduces bounds validation for node indices, label_off, and label_len against the declared node count and arena size. Refer to the MetaCPAN Changes Log for the release notes and the MetaCPAN Diff Comparison for the corresponding source changes in radix.h.

Workarounds

Place shared radix tree files on a filesystem writable only by the producing service, using 0600 or 0640 permissions
Isolate consumers and producers into separate user namespaces or containers to prevent local peer tampering
Validate the integrity of backing files with a signed checksum before attach if immediate patching is not possible

bash

# Upgrade the vulnerable Perl module and restrict backing file permissions
cpanm Data::RadixTree::Shared@0.02
chown radixproducer:radixgroup /var/lib/radixtree/shared.bin
chmod 0640 /var/lib/radixtree/shared.bin