CVE-2026-59147 is an out-of-bounds read and write vulnerability in the Perl module Data::DisjointSet::Shared versions prior to 0.02. The attach-time validator dsu_validate_header verifies header scalars and region layout against file size but does not validate the array contents. The dsu_find function uses a raw file-stored parent index without bounds checking against the node count, causing both reads and writes to occur out of bounds. A local attacker with write access to the backing file can craft data that passes header validation but poisons the parent array, resulting in memory corruption or crashes during find or union operations.

The vulnerability allows a local attacker who can write to the backing file to cause out-of-bounds memory access, potentially leading to memory corruption or process crashes. This can affect the stability and integrity of applications using the vulnerable Data::DisjointSet::Shared module. There is no indication of remote exploitation or known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict write access to the backing file to trusted users only to prevent exploitation. Monitor for updates from the vendor or maintainers regarding patches or official fixes.