CVE-2026-64613
Received Received - Intake

Insecure File Permissions in Data::Buffer::Shared Perl Module

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: CPANSec

Description
Data::Buffer::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without O_NOFOLLOW. The segment is created in buf_generic.h with open(path, O_RDWR|O_CREAT|O_EXCL, 0666). O_EXCL blocks a pre-seeded file on create, but the mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable), and O_NOFOLLOW is absent, so a symlink planted at the path is followed when the segment is attached. A "Shared" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted symlink at the path redirects the open to another file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-22
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-64613
EUVD
EUVD-2026-46369

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-732 The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Perl module Data::Buffer::Shared before version 0.05. It creates a shared memory file in directories like /tmp or /dev/shm that is readable by all users due to permissions set to 0644. The file is created without O_NOFOLLOW, allowing a symlink attack where an attacker can redirect the file to another location.

Detection Guidance

Check for world-readable files in shared directories like /tmp or /dev/shm. Look for files created with mode 0644 and no O_NOFOLLOW flag. Use commands like 'find /tmp -type f -perm 0644' to identify suspicious files.

Impact Analysis

An attacker with local access could read sensitive data stored in the shared memory segment, such as IPC payloads. This could lead to information disclosure, including credentials or other confidential data stored in memory.

Compliance Impact

This vulnerability could violate data protection requirements under GDPR and HIPAA by exposing sensitive data to unauthorized users. Compliance may be compromised due to unauthorized access to personal or health information.

Mitigation Strategies

Update Data::Buffer::Shared to version 0.05 or later. Ensure shared directories like /tmp or /dev/shm have strict permissions (e.g., 0700). Avoid using O_EXCL without O_NOFOLLOW in file creation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64613. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart