Data::HashMap::Shared versions prior to 0.14 for Perl contain an out‑of‑bounds read located in the shm_str_copy routine, which corresponds to CWE‑125. The routine copies raw data from a shared‑memory arena using an offset and length read directly from the mmap'd backing file without any bounds checking. A local user with write permission to the backing file can alter the record’s offset and length values. When the module subsequently iterates over, drains, or otherwise accesses the map, the memcpy operation may read from memory outside the intended region, exposing data adjacent in memory or causing the process to crash; this results in information disclosure or denial of service. The need for local write permission is inferred from the requirement to modify the backing file.

The vulnerability affects EGOR’s Data::HashMap::Shared Perl module. Any installation of this module with a version earlier than 0.14 is susceptible.

The vulnerability is scored CVSS 9.1 and has an EPSS of less than 1 %. The exploitation requires local write access to the shared‑memory file, an inference from the need to modify the backing file. Consequently, the attack vector is local, though the severity remains high. The low EPSS suggests limited real‑world exploitation. The vulnerability is not listed in the CISA KEV catalog.