External risk intelligence

Data::RadixTree::Shared Out-of-Bounds Read Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-59141

This is a Perl library used for memory-mapped data structures. It is a build-time or application-level dependency rather than a network-facing service, appliance, or gateway. Exposure requires a local peer to manipulate the backing file, making remote internet-based exploitation in common deployments very unlikely.

Out-of-bounds Read

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a vulnerability in Data::RadixTree::Shared, a Perl library used for managing memory-mapped data. The issue allows for an out-of-bounds read due to unvalidated indices, potentially leading to adjacent memory reads or crashes if a local user can modify the backing file. The main concern is confirming relevance and exposure within your environment.

Reading beyond memory boundaries.
Potential for data exposure or crashes.
Verify if this Perl library is used.

Attack Path

How an attacker could exploit the issue

An attacker with the ability to write to a backing file associated with the Data::RadixTree::Shared Perl module could manipulate node records. This manipulation, even if the file header appears valid, could lead to an out-of-bounds read when the `rdx_find_locked` function is called, potentially exposing sensitive memory or causing a crash.

Requires local file write access.
Triggered by calling `rdx_find_locked`.
Risk of memory reading or process crash.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect processes using the Data::RadixTree::Shared Perl module when processing a specially crafted file. An attacker with the ability to write to the backing file could cause an out-of-bounds read, potentially leading to the disclosure of adjacent memory contents or a crash.

Process memory, including sensitive information.
Malicious modification of the backing file.
Information disclosure or denial of service.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world remediation for this vulnerability likely involves application owners and potentially infrastructure or platform teams responsible for the Perl environments where Data::RadixTree::Shared is utilized. The initial step is to identify all instances of the affected library, determine if they are exposed to local manipulation of backing files, and assess business criticality before planning any maintenance.

Application owners should manage this issue.
Verify local file write access to backing files.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Data::RadixTree::Shared?

Data::RadixTree::Shared is a Perl library designed for managing memory-mapped data structures. Developers use it to store and search data efficiently by mapping files directly into a process's memory space, which allows for fast lookups in large datasets without loading everything into RAM at once.

What is the vulnerability in CVE-2026-59141?

This vulnerability is an out-of-bounds read, classified as CWE-125. It occurs because the library does not properly verify internal node and arena index values stored within a data file. When the library processes these unvalidated values, it may read memory locations outside the intended boundaries, which can cause the application to crash or potentially expose sensitive information from adjacent memory.

How is this vulnerability triggered?

The issue is triggered when a process calls the `rdx_find_locked` function to look up data in a compromised file. Crucially, the vulnerability does not trigger during standard, legitimate file operations. It requires an attacker to first obtain write access to the backing file to inject malicious node records that bypass initial header checks.

Is my system at risk according to Halo Surface Signal?

According to Halo Surface Signal, risk is considered very unlikely for most systems. Because this is an application-level library rather than a network-facing service or gateway, it lacks a direct path for remote internet-based exploitation. The threat is primarily localized, depending on whether an unauthorized user has the capability to modify the specific files the library uses.

How do I respond to this threat?

Start by identifying all applications or services in your environment that utilize the Data::RadixTree::Shared Perl module. Once located, evaluate which processes rely on files that could be accessed or modified by untrusted local users. Focus your defense on restricting file-system permissions to ensure that only authorized processes can read or write to these critical backing files.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.