The vulnerability in Data::SpatialHash::Shared (versions <0.02) arises from insufficient validation of array indices used in the functions sph_walk_cell and sph_alloc_slot. Although the attach-time validator sph_validate_header checks header scalars and region layout against file size, it does not validate the contents of arrays such as buckets and free lists. An attacker with local write access to the backing file can craft a valid header while poisoning bucket chains and free lists, leading to out-of-bounds reads and writes. Specifically, sph_walk_cell reads entries using unbounded bucket indices, and sph_alloc_slot writes through an unbounded free-list head index, resulting in memory corruption or crashes.

A local attacker who can modify the backing file can exploit this vulnerability to cause out-of-bounds memory access, leading to potential memory corruption or process crashes. This compromises the stability and reliability of applications using the affected Data::SpatialHash::Shared module.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local write access to the backing file to trusted users only to prevent exploitation.