CVE-2026-59144 Memory corruption in Data::RingBuffer::Shared
A local attacker can trigger a stack buffer overflow in the Perl Data::RingBuffer::Shared library by manipulating a shared memory file, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-59144?
CVE-2026-59144 is a critical memory corruption vulnerability in EGOR Data::RingBuffer::Shared, published on 21 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Data::RingBuffer::Shared versions before 0.04 for Perl allow a stack buffer overflow via an unvalidated elem_size in ring_read_seq.
The attach-time validator ring_validate_header checks the capacity-overflow and total_size consistency of the header but never caps elem_size against the destination size. ring_read_seq does memcpy(out, ring_slot(h, seq), elem_size) with elem_size read raw from the mmap'd segment, copying into a fixed 8-byte destination scalar. An elem_size larger than 8 bytes writes past the destination.
A local peer that can write the backing file can leave the header valid while setting a large elem_size, so the next read copies a file-controlled length into the fixed 8-byte stack buffer, corrupting adjacent stack frames.
Weakness: CWE-121
Which versions are affected by CVE-2026-59144?
How do I fix CVE-2026-59144?
No fix has been published for CVE-2026-59144 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-59144 being exploited?
There is no known exploitation of CVE-2026-59144 in the wild and no public exploit code.
Sources
Also known as GHSA-jxx5-5g59-8f3j.