The vulnerability resides in Data::DisjointSet::Shared versions before 0.02. The dsu_find routine walks a parent array using an index derived directly from the module’s backing file without checking that it is within the bounds of the node count. The attach‑time validator dsu_validate_header verifies only the header scalars and the layout against the file size, but it does not validate the contents of the parent array it then trusts. Based on the description, it is inferred that a local actor with write access to the backing file is the attack vector; such an actor can corrupt the parent array while keeping the header valid. The next call to dsu_find or dsu_union will then read and write out‑of‑bounds, corrupting adjacent memory or causing a crash. The underlying weakness is a classic buffer overrun (CWE‑125) compounded by an unchecked write (CWE‑787).

All installations of the EGOR Data::DisjointSet::Shared Perl module before version 0.02 are affected. Applications that rely on the module to maintain a disjoint‑set data structure and persist its state in a shared backing file are vulnerable.

The CVSS score of 9.8 indicates a high‑severity security issue, yet the EPSS score of less than 1% points to a low probability of exploitation at this time. The vulnerability requires a local user who can write to the backing file; systems that expose this file to users beyond the owning account increase the risk. The vulnerability is not presently listed in the CISA KEV catalog, but its severity warrants prompt attention.