CVE-2026-59141 is an out-of-bounds read vulnerability in Data::RadixTree::Shared versions prior to 0.02 for Perl. The vulnerability occurs in the rdx_find_locked function, which indexes node children and reads label offsets and lengths directly from a memory-mapped segment without bounds checking against node counts or arena sizes. Although the header scalars and region layout are validated at attach time, the node records themselves are not validated, allowing a local attacker with write access to the backing file to poison node records. This can cause out-of-bounds memory reads or process crashes when lookups dereference invalid node or arena indices.

An attacker with local write access to the backing file can exploit this vulnerability to cause out-of-bounds memory reads or crash the process using the Data::RadixTree::Shared module. The CVSS score of 9.1 indicates critical severity with high confidentiality impact and high availability impact, but no integrity impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local write access to the backing file used by Data::RadixTree::Shared to trusted users only to prevent poisoning of node records. Monitor for vendor updates regarding an official patch or workaround.