CVE-2026-59145 is an out-of-bounds read vulnerability in the Data::Intern::Shared Perl module versions prior to 0.02. The vulnerability arises because the attach-time validator si_validate_header does not validate the three arrays (slots, reverse, arena) it trusts. The si_idx_find function performs a triple indirection read from the mmap'd segment using indices from these arrays without bounds checking. A local attacker able to write to the backing file can craft valid headers but poison slot ids, reverse offsets, or arena length prefixes, causing out-of-bounds dereferences. This leads to disclosure of adjacent process memory when string() returns file-controlled data.

An attacker with local write access to the backing file can exploit this vulnerability to read memory beyond intended boundaries, potentially disclosing sensitive information from adjacent process memory. The vulnerability does not affect integrity but impacts confidentiality and availability, as indicated by the CVSS vector (Confidentiality: High, Integrity: None, Availability: High).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local write access to the backing file used by Data::Intern::Shared to trusted users only to prevent exploitation.