CVE-2026-65066

Name of the Vulnerable Software and Affected Versions Data::RingBuffer::Shared versions prior to 0.04

Description This issue occurs when a world-readable mmap backing file is created and opened without the O EXCL or O NOFOLLOW flags. The segment is created using the open() function with a mode of 0666, which, under a default umask of 022, results in a file mode of 0644, making it world-readable. Because O NOFOLLOW is absent, the system follows symlinks planted at the path, and the absence of O EXCL allows the use of a pre-planted file instead of failing. Since shared segments are typically located in shared directories like /tmp or /dev/shm, a local attacker can read Inter-Process Communication (IPC) payloads or use a symlink to win a pre-creation race and redirect the open operation.

Recommendations Update to version 0.04 or later.