Data::RadixTree::Shared for Perl Vulnerability Impacting Security

CVE-2026-65063

What is CVE-2026-65063?

The Data::RadixTree::Shared module for Perl contains a vulnerability that arises from incorrect file permission settings and the absence of locks during file operations. Specifically, when a world-readable mmap backing file is created, it could inadvertently allow local users to access sensitive data. This occurs because the file is created with permissions set to 0666, leading to it being world-readable under default umask settings. Furthermore, the module lacks O_NOFOLLOW and O_EXCL flags, compelling it to follow symbolic links and open unintended files, which could enable attackers to manipulate the file handling process to their advantage. As the segment resides in common shared directories, it exposes IPC payloads to any local user, posing a significant security risk.

References