Data::SpatialHash::Shared versions before 0.02 allow an unvalidated bucket, link, and free-list index to be used in sph_walk_cell and sph_alloc_slot, resulting in out-of-bounds reads and writes across the backing file. The vulnerability arises because the header validator checks size but does not validate array contents, permitting an attacker to corrupt the bucket chain or free-list head. If an attacker can write to the backing file, they can trigger memory corruption or a crash. The weakness matches CWE-125 (Out‑of‑Bounds Read) and CWE-787 (Out‑of‑Bounds Write).

All releases of EGOR Data::SpatialHash::Shared prior to version 0.02 are affected. Upgrading to 0.02 or later mitigates the issue. Products older than 0.02 lack the bounds checking that protects entry indices.

The CVSS score of 7.8 demonstrates a high severity level, while the EPSS score of less than 1% indicates limited exploitation likelihood at present. The flaw is not listed in the CISA KEV catalog. An attacker must have local write access to the shared file to manipulate bucket chains or free lists; thus the attack vector is local rather than remote. Once the file is tampered with, a read or write operation can trigger memory corruption or a crash. Given the low exploitation probability and local nature, the risk remains a high severity for affected environments, but practical exploitation would require a compromised local user.