Data::NDArray::Shared CVE-2026-64616

Exploitation requires a local user account on the same host as the process using Data::NDArray::Shared before 0.02 (CVSS PR:L, AV:L). The module must be actively creating shared memory segments, and those segments must be placed in a world-writable directory such as /tmp or /dev/shm - the default behavior. Two distinct attack paths exist with different prerequisites: (1) Passive read - no race required; the attacker simply reads the 0644 backing file at any point after it is created, requiring only that they know or can discover the segment path; (2) Pre-creation race or symlink plant - the attacker must create a file or symlink at the expected segment path before the victim process does, which requires write access to the containing directory (satisfied by /tmp or /dev/shm) and either predictable path naming or filesystem monitoring. Exploitation is entirely precluded on systems with only a single trusted local user, in containers with private /tmp namespaces (unshared mount namespaces), or where the backing file is placed in a directory with restricted permissions. The impact is limited to reading whatever data the application stores in the shared segment (CVSS C:L); there is no integrity or availability impact.

The CVSS 3.1 score of 3.3 (Low) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N correctly characterizes the constrained attack surface: exploitation is local-only (AV:L) and requires at minimum a standard user account (PR:L). The passive disclosure path - simply reading the world-readable backing file after it is created - requires no race and no special skill, making AC:L appropriate for that vector; the pre-plant and symlink attacks add timing requirements but do not raise the overall AC given the simpler passive path also exists. The EPSS score of 0.16% at the 6th percentile is consistent with the niche deployment footprint of this obscure CPAN module and the local-only attack surface. There is no CISA KEV listing and no known POC, reinforcing that this is not under active exploitation. Real-world risk is highest in shared-hosting, CI/CD pipeline workers, or HPC cluster environments where multiple untrusted Unix users coexist on the same host and the module is used to pass data of any sensitivity between cooperating processes. In single-user or containerized environments with proper namespace isolation, practical risk is negligible.

A local attacker with a standard Unix account on a shared system identifies the predictable path that a target process will use for its Data::NDArray::Shared backing file in /tmp. Before the target process starts, the attacker plants a symlink at that path pointing to a file the attacker owns and can read; when the victim process opens the path without O_NOFOLLOW, it follows the symlink, and the attacker subsequently reads the mmap contents containing the shared IPC payload. Alternatively, the attacker simply waits for the backing file to be created and reads it directly, exploiting the world-readable 0644 permissions without any race condition. No public exploit code has been identified at time of analysis.