PT-2026-62051 · Egor · Data::Ringbuffer::Shared
CVE-2026-59144
·
Published
2026-07-21
·
Updated
2026-07-21
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Data::RingBuffer::Shared versions before 0.04 for Perl allow a stack buffer overflow via an unvalidated elem size in ring read seq.
The attach-time validator ring validate header checks the capacity-overflow and total size consistency of the header but never caps elem size against the destination size. ring read seq does memcpy(out, ring slot(h, seq), elem size) with elem size read raw from the mmap'd segment, copying into a fixed 8-byte destination scalar. An elem size larger than 8 bytes writes past the destination.
A local peer that can write the backing file can leave the header valid while setting a large elem size, so the next read copies a file-controlled length into the fixed 8-byte stack buffer, corrupting adjacent stack frames.
Stack Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Data::Ringbuffer::Shared