The vulnerability in Data::RingBuffer::Shared (<0.04) arises from improper validation of the elem_size parameter in the ring_read_seq function. Although the ring_validate_header function checks capacity-overflow and total_size consistency, it does not limit elem_size relative to the fixed 8-byte destination buffer. Consequently, memcpy copies elem_size bytes from a memory-mapped segment into an 8-byte stack buffer, leading to a stack-based buffer overflow. A local attacker who can write to the backing file can craft a valid header with an oversized elem_size, triggering the overflow on the next read.

Exploitation of this vulnerability allows a local attacker with write access to the backing file to cause a stack buffer overflow, potentially leading to memory corruption. This could result in application crashes or arbitrary code execution depending on the context and further exploitation. No remote exploitation or known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local write access to the backing file used by Data::RingBuffer::Shared to trusted users only to prevent manipulation of elem_size. Monitor for vendor updates addressing this vulnerability.