CVE-2026-59143: Perl RoaringBitmap Buffer Overflow Flaw

CVE-2026-59143 Overview

CVE-2026-59143 is an out-of-bounds read vulnerability [CWE-125] in the Data::RoaringBitmap::Shared Perl module before version 0.02. The flaw resides in rb_contains_locked, which trusts file-stored bucket contents that the attach-time validator rb_validate_header never checks. A local peer with write access to the backing file can poison a bucket while keeping the header valid. The next membership query then dereferences a file-controlled wild pointer and scans a file-controlled cardinality, leaking adjacent memory or crashing the Perl process.

Critical Impact
Local attackers with write access to the shared backing file can trigger out-of-bounds reads, exposing adjacent process memory or causing a denial of service in Perl applications using the module.

Affected Products

Data::RoaringBitmap::Shared for Perl, versions prior to 0.02
Perl applications that memory-map or attach shared roaring bitmap files produced by untrusted local peers
Multi-tenant hosts where a local user can write to the backing file consumed by another process

Discovery Timeline

2026-07-21 - CVE-2026-59143 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-59143

Vulnerability Analysis

The vulnerability affects the file-attach path of Data::RoaringBitmap::Shared, a Perl module that provides a shared, file-backed roaring bitmap data structure. At attach time, rb_validate_header verifies the header scalars and region layout against the file size. It does not, however, validate the per-bucket metadata that later code paths rely on.

When a Perl caller performs a membership query, rb_contains_locked computes a container pointer as pool + container_off * 8192 using the raw file-stored offset. It then iterates over a file-stored cardinality value while searching the container. Neither the offset nor the cardinality is bounded against the container pool capacity or the fixed 8192-byte slot size.

Because the header remains structurally valid, the module accepts a file whose bucket entries point outside the mapped pool. Subsequent reads occur at attacker-chosen addresses within the process, returning arbitrary adjacent memory to the query or crashing the interpreter on unmapped pages.

Root Cause

The root cause is missing input validation on trusted-looking file contents. rb_validate_header covers the outer layout, but the bucket table it references is treated as authoritative. container_off and cardinality values propagate directly into pointer arithmetic and loop bounds without range checks against the pool capacity or slot size.

Attack Vector

A local peer with write access to the backing file crafts a payload that preserves the header invariants while poisoning one or more buckets. When any process attaches the file and issues a membership query for the affected key, rb_contains_locked follows the wild pointer and reads cardinality * entry_size bytes from a location the attacker chose. This produces information disclosure of adjacent process memory or a process crash.

The vulnerability manifests entirely inside the module's C-backed roaring bitmap logic. See the MetaCPAN Release Diff for the exact code changes in roaring.h.

Detection Methods for CVE-2026-59143

Indicators of Compromise

Unexpected SIGSEGV or SIGBUS crashes in Perl processes that attach Data::RoaringBitmap::Shared files
Backing files whose bucket container_off values, when multiplied by 8192, exceed the mapped pool size
Bucket cardinality fields that exceed the fixed 8192-byte slot capacity
Writes to shared roaring bitmap files by local user accounts that do not normally produce them

Detection Strategies

Audit installed Perl modules and flag any Data::RoaringBitmap::Shared version below 0.02 using cpan -l or corelist inventories
Add offline validation that recomputes container_off * 8192 against pool capacity and checks each bucket cardinality against the slot size before attach
Monitor file integrity on shared roaring bitmap files with tools such as auditd or OSSEC to record every writer

Monitoring Recommendations

Alert on Perl worker crashes correlated with recent modifications to .rb or roaring bitmap backing files
Log all open() calls with write intent against directories holding shared bitmap files and review unfamiliar UIDs
Track module version drift in production hosts and gate deployments on the patched 0.02 release

How to Mitigate CVE-2026-59143

Immediate Actions Required

Upgrade Data::RoaringBitmap::Shared to version 0.02 or later on every host that consumes shared bitmap files
Restrict write permissions on backing files to a single trusted producer account using strict filesystem ACLs
Treat any existing shared bitmap file authored by an untrusted local peer as suspect and regenerate it from a trusted source

Patch Information

The maintainer fixed the issue in Data-RoaringBitmap-Shared-0.02. The patched rb_contains_locked and related routines now validate container_off against the pool capacity and cap cardinality at the 8192-byte slot size. Review the MetaCPAN Release Changes for the full changelog and the corresponding code diff.

Workarounds

Place backing files on filesystems where only the producing service account holds write permission, denying local peers the ability to poison buckets
Wrap attach calls with a Perl-side validator that walks each bucket and rejects offsets or cardinalities outside the pool bounds before invoking membership queries
Isolate consumers in separate user namespaces or containers so that a compromised local account cannot reach shared bitmap files used by other tenants

bash

# Upgrade the vulnerable module to the patched release
cpanm Data::RoaringBitmap::Shared@0.02

# Verify the installed version
perl -MData::RoaringBitmap::Shared -e 'print $Data::RoaringBitmap::Shared::VERSION, "\n"'

# Restrict write access on the backing file to the trusted producer
chown roaring-producer:roaring /var/lib/roaring/shared.rb
chmod 640 /var/lib/roaring/shared.rb