Data::RadixTree::Shared versions prior to 0.02 for Perl contain an out‑of‑bounds read in the rdx_find_locked routine. The code reads node records without bounds checking after verifying only the header of the backing file. As a result, an attacker can cause the module to dereference an invalid node or arena index, exposing adjacent memory contents or crashing the process. This flaw is classified as CWE‑125 (Out‑of‑Bounds Read).

The vulnerability affects Perl modules named Data::RadixTree::Shared provided by EGOR. Versions earlier than 0.02 are impacted. The issue is relevant to any environment that uses the module with its backing file mechanism, regardless of the Perl interpreter version used.

The CVSS rating of 9.1 signals a high‑severity flaw, though the EPSS score of less than 1 % indicates that widespread exploitation is currently unlikely. Based on the description, it is inferred that a local attacker who can write to the module's backing file is required; it is not remotely exploitable over the network. Because local write access is needed, the risk is confined to environments where user accounts or processes with write permissions to the backing file exist. The vulnerability is not listed in the CISA KEV catalog.