Vulnerability in Data::RingBuffer::Shared for Perl Affects Local File Permissions
CVE-2026-65066
Currently unrated
What is CVE-2026-65066?
A vulnerability in the Data::RingBuffer::Shared module for Perl allows for the creation of world-readable memory-mapped files. Due to improper file permissions applied during the creation of these files, any local user can potentially access sensitive IPC (Inter-process Communication) payloads. The absence of O_NOFOLLOW means that a symbolic link placed at the file path will be followed, and without O_EXCL, pre-existing files can be opened silently by the application. This configuration can be exploited by local attackers to redirect outputs or access sensitive information stored within the shared memory.
Affected Version(s)
Data::RingBuffer::Shared 0 < 0.04