CVE-2026-65069

Name of the Vulnerable Software and Affected Versions Data::DisjointSet::Shared versions prior to 0.02

Description This issue occurs when the software creates a world-readable mmap backing file and opens it without using the O EXCL or O NOFOLLOW flags. The segment is created in dsu.h using the open() function with a mode of 0666, which, under a default umask of 022, results in a file mode of 0644, making it readable by any local user. Because O NOFOLLOW is missing, the system follows symlinks planted at the path, and the absence of O EXCL allows the use of a pre-planted file instead of failing. Since shared segments are typically located in shared directories like /tmp or /dev/shm, a local attacker can read Inter-Process Communication (IPC) payloads or use a symlink to redirect the open operation.

Recommendations Update to version 0.02 or later.