Data::RoaringBitmap::Shared versions before 0.02 contain an unvalidated container offset and cardinality check in rb_contains_locked, which allows an out-of-bounds read. Dereferencing a file‑controlled pointer can reveal adjacent memory contents or crash the process, a manifestation of the out-of-bounds read weakness (CWE-125). The vulnerability can lead to inadvertent data leakage or denial of service if an attacker gains access to the shared backing file.

The affected product is Data::RoaringBitmap::Shared by EGOR, any version prior to 0.02. The issue is tied to the shared memory file used for exploding bitmap data in Perl scripts.

The CVSS score of 6.3 indicates moderate severity, while the EPSS score of less than 1% suggests low exploitation probability. This vulnerability is not listed in CISA KEV. Exploitation requires local write access to the shared backing file, so a local peer with sufficient privileges can tamper with the bucket contents to trigger the out-of-bounds read. The lack of bounds checks in the container pointer construction makes the attack straightforward once the arbitrary write condition is satisfied.