CVE-2026-59140 is an out-of-bounds read vulnerability in Data::SortedSet::Shared versions prior to 0.03. The attach-time validator only checks the root index against the node pool capacity, but rank and min/max queries follow child node indices that are read directly from the mmap'd segment without bounds checking. A local attacker with write access to the backing file can craft poisoned tree links that cause these queries to dereference out-of-bounds indices, resulting in memory disclosure or process crashes. Although a comprehensive tree validation method exists, it is not invoked automatically on attach, leaving the vulnerability exploitable.

An attacker with local write access to the backing file can cause out-of-bounds memory reads or crashes in processes using vulnerable versions of Data::SortedSet::Shared. This can lead to potential information disclosure or denial of service. The CVSS score of 9.1 reflects the critical severity due to network attack vector, no privileges required, no user interaction, high confidentiality impact, and high availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using vulnerable versions or restrict local write access to the backing file to trusted users. Running the explicit full structural validation method (ss_validate_tree) after attaching the data structure may help detect corruption but is not an automatic fix.