CVE-2026-65065

Name of the Vulnerable Software and Affected Versions Data::RoaringBitmap::Shared versions prior to 0.02

Description This issue occurs when creating a world-readable mmap backing file and opening it without the O EXCL or O NOFOLLOW flags. The segment is created using the open() function with a mode of 0666, which, under a default umask of 022, results in a file mode of 0644, making it world-readable. Because O NOFOLLOW is absent, the system follows symlinks planted at the path, and the absence of O EXCL allows the use of a pre-planted file instead of failing. Since shared segments are typically located in shared directories like /tmp or /dev/shm, a local attacker can read Inter-Process Communication (IPC) payloads or use a symlink to redirect the open operation.

Recommendations Update to version 0.02 or later.