The flaw in Data::ReqRep::Shared exists because the module copies data from a shared arena without checking that the provided offset and length stay within the arena capacity. A local attacker, if able to modify the backing file, can leave the header valid but set a request slot’s offset and length to values that extend beyond the arena limits, causing the process to read or copy data beyond the arena. Based on the description, this out-of-bounds read could potentially expose arbitrary memory contents or lead to a crash, but the exact impact is not stated explicitly in the CVE text.

All installations of EGOR:Data::ReqRep::Shared prior to version 0.05 on Perl systems are vulnerable. The vulnerability applies to the module’s shared memory handling, affecting any process that uses reqrep_recv_locked to receive requests.

The EPSS score is below 1% and the vulnerability is not listed in CISA’s KEV catalog, indicating a low but non‑zero exploitation probability in typical environments. Exploitation requires local write access to the shared arena backing file; therefore the attack vector is local. The CVSS score of 9.1 highlights a high severity impact; based on the description, an attacker could read arbitrary memory or cause the process to crash, but the CVE text does not detail the specific data leakage or denial‑of‑service outcomes, so those results are inferred.