Data::Deque::Shared CVE-2026-64614

Exploitation requires a local user account on a multi-user POSIX host running an application built with Data::Deque::Shared versions before 0.06. The passive attack path - directly reading the world-readable mmap backing file - requires only filesystem read access to /tmp or /dev/shm and knowledge (or guessing) of the backing file name; no race condition or special timing is needed. The symlink/pre-creation attack additionally requires the attacker to plant a symlink or file at the exact backing file path before the target process first initializes the segment, requiring knowledge of the file path naming convention. Exploitation is limited to single-host scenarios where /tmp or /dev/shm is shared across user accounts; containerized deployments with private /tmp namespaces, single-user workstations, and environments with sticky-bit directories that restrict cross-user symlink creation (e.g., Linux protected_symlinks sysctl enabled) substantially reduce or eliminate practical exploitability.

The CVSS 3.1 score of 3.8 (Low) with vector AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N accurately characterizes the risk envelope: local access with a standard user account is required (AV:L, PR:L), and the impact is limited to confidentiality of the IPC segment contents (C:L). The scope change (S:C) reflects the cross-process data leakage boundary. EPSS at 0.16% in the 6th percentile confirms that virtually no observed exploitation activity exists for this class of flaw, consistent with the niche deployment footprint of this Perl library. The vulnerability is not in CISA KEV and no POC code has been identified in the provided data. Despite the low severity score, contextual risk is non-trivial for applications using this module to share sensitive data (credentials, session tokens, business logic payloads) between processes on a multi-user host: the passive attack path requires no race condition at all - the attacker simply reads the backing file. Single-user hosts and containerized deployments with isolated /tmp namespaces are not at practical risk, which substantially limits the real-world population of affected deployable configurations.

A local attacker with a standard user account on a shared Linux host identifies that an application is using Data::Deque::Shared and predicts the mmap backing file path in /tmp. Without any race condition, the attacker simply reads the world-readable 0644 backing file directly, extracting the full contents of the IPC deque - including any sensitive payloads the application has enqueued. Alternatively, the attacker pre-plants a symlink at the expected backing file path before the target process starts; when the application calls open() without O_NOFOLLOW, the kernel follows the symlink to an attacker-controlled file, redirecting the segment.