The vulnerability in Data::RoaringBitmap::Shared (pre-0.02) arises from rb_contains_locked using unvalidated offsets and cardinality values from a file to form pointers and iterate over memory. Although the header is validated at attach time, the bucket contents are not, allowing a maliciously crafted backing file to cause out-of-bounds memory reads. This can lead to process crashes or disclosure of adjacent memory contents. Exploitation requires local write access to the backing file. The CVSS 3.1 base score is 6.3, reflecting a medium severity with network attack vector, low attack complexity, and low privileges required.

An attacker with local write access to the backing file can craft data that causes rb_contains_locked to read memory out-of-bounds. This may result in process crashes (denial of service) or disclosure of adjacent memory contents (information leak). The vulnerability affects confidentiality, integrity, and availability to a limited extent.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local write access to the backing file to trusted users only to prevent exploitation.