EUVD-2026-46378

Data::RoaringBitmap::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in roaring.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644...

EUVD-2026-46364

Data::RoaringBitmap::Shared versions before 0.02 for Perl allow an out-of-bounds read via an unvalidated container offset and cardinality in rbcontainslocked. The attach-time validator rbvalidateheader checks the header scalars and region layout against the file size, but does not validate the...

CVE-2026-65065

Data::RoaringBitmap::Shared for Perl versions before 0.02 contains a world-readable mmap backing file created by open(path, O_RDWR|O_CREAT, 0666) in roaring.h. The mode 0666 with default umask 022 yields 0644 (world-readable). Absence of O_NOFOLLOW allows a symlink at the path to be followed, and...

CVE-2026-59143

Data::RoaringBitmap::Shared for Perl (versions before 0.02) contains an out-of-bounds read in rb_contains_locked due to unvalidated container_offset and cardinality. The attach-time validator validates header scalars/region size but not bucket contents, then uses pool + container_off * 8192 to fo...

CVE-2026-59143 Data::RoaringBitmap::Shared versions before 0.02 for Perl allow an out-of-bounds read via an unvalidated container offset and cardinality in rb_contains_locked

Data::RoaringBitmap::Shared versions before 0.02 for Perl allow an out-of-bounds read via an unvalidated container offset and cardinality in rbcontainslocked. The attach-time validator rbvalidateheader checks the header scalars and region layout against the file size, but does not validate the...

OSV-2023-165 Heap-buffer-overflow in array_container_to_uint32_array

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56893 Crash type: Heap-buffer-overflow WRITE 4 Crash state: arraycontainertouint32array ratouint32array roaringbitmapserialize...