CVE-2026-59147 is an out-of-bounds read and write vulnerability in the Perl module Data::DisjointSet::Shared versions prior to 0.02. The vulnerability is due to the dsu_find function using an unvalidated parent index derived from a file-stored array, which is not bounded by the node count. Although the attach-time validator dsu_validate_header checks header scalars and region layout against file size, it does not validate the array contents. This allows a local attacker who can write to the backing file to craft a valid header but poison the parent array, leading to out-of-bounds memory access during subsequent find or union operations. The CVSS 3.1 score is 9.8, indicating critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with local write access to the backing file to cause out-of-bounds memory reads and writes, potentially leading to memory corruption, process crashes, and possibly arbitrary code execution. The vulnerability affects confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local write access to the backing file used by Data::DisjointSet::Shared to trusted users only to prevent poisoning of the parent array. Monitor for updates from the EGOR project regarding an official fix.