World-Readable Mapping Flaw in Perl Data::NDArray::Shared by Egor

CVE-2026-64616

What is CVE-2026-64616?

The Perl Data::NDArray::Shared module, in versions prior to 0.02, has a vulnerability that allows the creation of a world-readable memory mapping (mmap) file. This is due to improper file creation permissions, which result in a file that is accessible by all users. The absence of O_NOFOLLOW allows exploitation through symbolic links, where an attacker can direct file operations to a pre-existing file or a malicious symlink. This flaw can expose sensitive Inter-Process Communication (IPC) payloads stored in shared directories like /tmp or /dev/shm, leading to potential data leaks and unauthorized access to sensitive information.

References