CVE-2026-59143 is an out-of-bounds read vulnerability in Data::RoaringBitmap::Shared versions prior to 0.02. The vulnerability arises because the rb_contains_locked function uses file-stored offsets and cardinalities without validating them against container pool capacity or slot size. Although the attach-time validator rb_validate_header checks header scalars and region layout against file size, it does not validate the bucket contents, which rb_contains_locked trusts. A local attacker able to write the backing file can craft a valid header but poison bucket data, causing rb_contains_locked to dereference a file-controlled wild pointer and read beyond intended memory bounds or crash the process.

An attacker with local write access to the backing file can cause out-of-bounds reads, potentially leading to information disclosure of adjacent memory or denial of service via process crashes. There is no indication of remote exploitation or known exploits in the wild. The impact is limited to local users who can modify the backing file.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local write access to the backing file to trusted users only to prevent exploitation of this vulnerability.