Data::ReqRep::Shared CVE-2026-65061

Exploitation requires a local user account on the same host as a process running Data::ReqRep::Shared versions before 0.05. For the passive disclosure path (reading IPC payloads), the only prerequisite is that the backing file exists in a world-readable shared directory (e.g., /tmp or /dev/shm) under the default umask of 022 - no race condition, no timing, and no special configuration beyond the library being in active use. For the symlink or pre-creation attack paths, the attacker must be able to write to the same directory as the backing file and must act before the target process first creates it. Exploitation is limited to multiuser Unix/Linux environments; containers with isolated /tmp namespaces (systemd PrivateTmp=true), single-user systems, or deployments using a non-standard backing directory with restricted permissions are not exposed. A non-default umask of 0077 prevents the world-readable condition but does not fix the absent O_EXCL/O_NOFOLLOW flags.

The provided CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N scores 3.8, which is well-calibrated: exploitation is constrained to local, low-privileged access, with limited confidentiality impact and no integrity or availability consequence. The scope change (S:C) is justified because the attacker reads IPC data belonging to a separate process, crossing a security boundary. EPSS at 0.16% (6th percentile) corroborates that real-world exploitation is currently negligible. The vulnerability is absent from CISA KEV and no POC exists. Practical risk is meaningful only on multiuser Linux/Unix hosts where untrusted local users share the same /tmp or /dev/shm namespace with processes using this library - a deployment pattern that narrows the exposed population considerably. Single-user systems, containers with per-namespace /tmp, or environments enforcing per-user temporary directories are not realistically affected. No data conflicts are present between the CVSS vector, description, and EPSS signals.

A local attacker with a standard shell account on a multiuser system identifies the predictable mmap backing file path used by a running service (e.g., /tmp/reqrep-<name>) and either reads the world-readable file directly to harvest IPC payload data, or races the service startup by pre-creating a file or symlink at that path before the service opens it. No special tooling is required - standard shell commands suffice - and no public exploit code has been identified, but the technique is a well-documented TOCTOU/symlink pattern requiring no elevated privileges.