CVE-2026-59142 is an out-of-bounds read vulnerability in Data::HashMap::Shared versions prior to 0.14. The flaw exists in the shm_str_copy function, which performs memcpy using offset and length values read directly from a memory-mapped segment without proper validation. Although the attach-time validator shm_validate_header checks header scalars and region layout against file size, it does not validate the array contents, which are then trusted. A local attacker who can write to the backing file can craft a valid header but poison a record's offset and length, causing out-of-bounds reads or process crashes when iterating or draining the map. The get path is not affected as it bounds offset and length separately.

An attacker with local write access to the backing file can cause out-of-bounds reads or application crashes by manipulating offset and length values used in memory copy operations. This can lead to exposure of adjacent memory contents or denial of service due to process crashes. There is no indication of remote exploitation or privilege escalation from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict write access to the backing file to trusted users only to prevent poisoning of offset and length values. Avoid using affected versions in untrusted environments.