CVE-2026-59142 describes an out-of-bounds read vulnerability in Data::HashMap::Shared versions prior to 0.14. The vulnerability arises because the shm_str_copy function performs memcpy operations using offset and length values read directly from a memory-mapped segment without proper validation. Although the attach-time validator checks header scalars and region layout against file size, it does not validate the array contents, which are then trusted. A local attacker with write access to the backing file can craft a valid header but poison record offsets and lengths, leading to out-of-bounds reads or crashes when iterating or draining the map. The get path is unaffected due to separate bounds checking. This vulnerability is tracked as CWE-125 (Out-of-bounds Read) and has a CVSS 3.1 score of 9.1, indicating critical severity.

An attacker with local write access to the backing file can cause the application to read memory beyond the intended bounds, potentially leaking sensitive information or causing a denial of service via process crashes. The vulnerability affects confidentiality and availability but not integrity. Remote exploitation is not indicated; the attacker must have local file write permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local write access to the backing file used by Data::HashMap::Shared to trusted users only. Avoid using affected versions in untrusted environments.