A critical out-of-bounds read vulnerability in Data::HashMap::Shared allows unauthorized memory access or process termination, necessitating an immediate update to version 0.14 or later.

The vulnerability exists in the shm_str_copy function, which fails to validate arena offsets and lengths before performing memory copies. An attacker capable of writing to the backing file can poison record metadata, allowing them to read adjacent memory or crash the application process.

Successful exploitation of this flaw can lead to significant information disclosure, as an attacker may read sensitive data residing in adjacent memory. Furthermore, the ability to trigger a process crash results in denial of service for applications relying on this library. Given the CVSS score of 9.1, this vulnerability is classified as critical due to its potential for remote, unauthenticated exploitation.

Immediate Action: Upgrade to Data::HashMap::Shared version 0.14 or later, which correctly bounds arena offsets and lengths to prevent unauthorized memory access.

Proactive Monitoring: Monitor application logs for segmentation faults, unexpected process crashes, or abnormal memory usage patterns associated with the Data::HashMap::Shared library.

Compensating Controls: If immediate patching is not feasible, restrict file system access to the backing file to prevent unauthorized parties from poisoning the shared memory segment.

Public Exploit Available: Unknown

The critical nature of this vulnerability, combined with the ease of exploitation, requires that all organizations utilizing Data::HashMap::Shared prioritize this update. Administrators should identify all instances of the affected software within their environment and apply the fix immediately to eliminate the risk of memory corruption and unauthorized data exposure.