CVE-2026-59140 is an out-of-bounds read vulnerability in Data::SortedSet::Shared versions prior to 0.03. The attach-time validation (ss_validate_header) only checks the root node index against the node pool capacity, but the rank and min/max query paths dereference child node indices directly from the mmap'd segment without bounds checking. Although a full tree structural validation (ss_validate_tree) exists, it is not automatically run on attach, allowing a local attacker with write access to the backing file to poison tree links. This leads to out-of-bounds reads or crashes when queries access invalid node indices.

A local attacker with write access to the backing file can manipulate tree node indices to cause out-of-bounds memory reads or crashes in processes performing rank or min/max queries. This can lead to information disclosure of adjacent memory or denial of service due to process termination.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local write access to the backing file to trusted users only. Consider running the explicit full structural validation method (ss_validate_tree) after attaching to detect corrupted tree structures.