CVE-2026-59144
Data::RingBuffer::Shared versions before 0.04 for Perl allow a stack buffer overflow via an unvalidated elem_size in ring_read_seq
The attach-time validator ring_validate_header checks the capacity-overflow and total_size consistency of the header but never caps elem_size against the destination size. ring_read_seq does memcpy(out, ring_slot(h, seq), elem_size) with elem_size read raw from the mmap'd segment, copying into a fixed 8-byte destination scalar. An elem_size larger than 8 bytes writes past the destination.
A local peer that can write the backing file can leave the header valid while setting a large elem_size, so the next read copies a file-controlled length into the fixed 8-byte stack buffer, corrupting adjacent stack frames.
Affected Products
-
CVE record
-
NVD configurations
No data
-
Red Hat packages
No data
-
OpenCVE enrichment
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| EGOR | Data::RingBuffer::Shared | unaffected |
|
No data.
No data.
| Vendor | Product | Versions | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Egor | Data::ringbuffer::shared |
|
Remediation
Vendor Solution
Upgrade to Data::RingBuffer::Shared 0.04 or later, which pins elem_size to the fixed element size of the buffer's registered variant.
Vendor Workaround
For deployments that cannot upgrade to 0.04, place the backing file in a directory writable only by the owning user, so a local peer cannot tamper with the elem_size the read path trusts.
Tracking
Advisories
Metrics
No CVSS v4.0
Attack Vector Network
Attack Complexity Low
Privileges Required None
Scope Unchanged
Confidentiality Impact High
Integrity Impact High
Availability Impact High
User Interaction None
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.598% probability within 30 days)
Exploitation none
Automatable yes
Technical Impact total
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Egor
Egor data::ringbuffer::shared |
|
| Vendors & Products |
Egor
Egor data::ringbuffer::shared |
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Data::RingBuffer::Shared versions before 0.04 for Perl allow a stack buffer overflow via an unvalidated elem_size in ring_read_seq. The attach-time validator ring_validate_header checks the capacity-overflow and total_size consistency of the header but never caps elem_size against the destination size. ring_read_seq does memcpy(out, ring_slot(h, seq), elem_size) with elem_size read raw from the mmap'd segment, copying into a fixed 8-byte destination scalar. An elem_size larger than 8 bytes writes past the destination. A local peer that can write the backing file can leave the header valid while setting a large elem_size, so the next read copies a file-controlled length into the fixed 8-byte stack buffer, corrupting adjacent stack frames. | |
| Title | Data::RingBuffer::Shared versions before 0.04 for Perl allow a stack buffer overflow via an unvalidated elem_size in ring_read_seq | |
| Weaknesses | CWE-121 | |
| References |
|
