A critical out of bounds read vulnerability in the EGOR Data::SortedSet::Shared Perl library allows unauthenticated remote attackers to disclose sensitive memory or cause a denial of service.

The vulnerability stems from insufficient bounds checking of node indices during order statistics and min/max queries. An unauthenticated attacker can trigger this condition if they can influence the backing file, causing the process to dereference out of bounds memory.

The exploitation of this vulnerability can lead to unauthorized disclosure of adjacent memory or service disruption via application crashes. Given the CVSS score of 9.1, this flaw is categorized as critical because it allows for unauthenticated, network-based exploitation, posing a significant risk to the integrity and availability of applications relying on this library.

Immediate Action: Upgrade to Data::SortedSet::Shared version 0.03 or later, which implements mandatory bounds checking for all node indices before dereferencing.

Proactive Monitoring: Monitor application logs for unexpected process crashes or segmentation faults that may indicate an attempt to trigger out of bounds memory access.

Compensating Controls: Ensure strict file system permissions on the backing files used by the library to prevent unauthorized local peers from poisoning the tree structure.

Public Exploit Available: No

Due to the critical severity and the potential for remote exploitation, organizations using the affected Perl library must prioritize an immediate update to version 0.03. Failure to patch leaves systems vulnerable to memory corruption and potential denial of service attacks.