World-Readable Backing File in Data::HashMap::Shared for Perl by EGOR

CVE-2026-65064

What is CVE-2026-65064?

The Data::HashMap::Shared module for Perl prior to version 0.14 contains a security flaw that results in the creation of a world-readable memory-mapped file. This occurs due to a combination of file permission settings and the absence of important flags during the file creation process. The affected code opens a backing file with permissive mode 0666 without using O_NOFOLLOW or O_EXCL, thus allowing local attackers to exploit a pre-creation race condition or manipulate symlinks to access potentially sensitive interprocess communication (IPC) data. The vulnerability primarily impacts segments stored in shared directories, making the IPC payloads accessible to any local user.

References