CVE-2026-59146 describes an out-of-bounds write and read vulnerability in Data::SpatialHash::Shared versions prior to 0.02. The vulnerability stems from insufficient validation of bucket, link, and free-list indices used in the functions sph_walk_cell and sph_alloc_slot. Although the attach-time validator sph_validate_header verifies header scalars and region layout against file size, it does not validate the array contents that are subsequently trusted. A local attacker with write access to the backing file can craft a valid header while poisoning bucket chains and free lists, causing sph_walk_cell to read out-of-bounds entries and sph_alloc_slot to write out-of-bounds via the free-list head index. This leads to memory corruption or process crashes.

Successful exploitation allows a local attacker with write access to the backing file to cause memory corruption or crash the process using Data::SpatialHash::Shared. The vulnerability affects confidentiality, integrity, and availability, as indicated by the CVSS vector (C:H/I:H/A:H). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local write access to the backing file to trusted users only to prevent exploitation. Monitor for updates from the vendor or maintainers regarding patches or official fixes.