Data::RingBuffer::Shared versions before 0.04 for Perl allow a stack buffer overflow via an unvalidated elemsize in ringreadseq.

The attach-time validator ringvalidateheader checks the capacity-overflow and totalsize consistency of the header but never caps elemsize against the destination size. ringreadseq does memcpy(out, ringslot(h, seq), elemsize) with elemsize read raw from the mmap'd segment, copying into a fixed 8-byte destination scalar. An elemsize larger than 8 bytes writes past the destination.

A local peer that can write the backing file can leave the header valid while setting a large elemsize, so the next read copies a file-controlled length into the fixed 8-byte stack buffer, corrupting adjacent stack frames.