Data::SortedSet::Shared CVE-2026-65062

Exploitation requires a local account with low (unprivileged) access on the same multi-user system running an application that uses Data::SortedSet::Shared before 0.03, with the module's mmap backing file located in a shared directory such as /tmp or /dev/shm (the module's natural default). The passive disclosure path - reading the world-readable 0644 file - requires no race condition and no special timing; any local user can simply open and read the file after it is created by the legitimate process. The symlink/pre-creation race path additionally requires the attacker to plant a symlink or pre-created file at the expected path before the target process first opens it. Exploitation is strictly limited to local system access; no network vector exists. Risk is further limited by the niche footprint of the module and the requirement that the targeted application store sensitive data in the shared segment.

The CVSS 3.1 base score of 3.8 with vector AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N correctly captures a local, low-privilege, no-interaction attack with a scope change (cross-process IPC data disclosure) but only low confidentiality impact and no integrity or availability impact. EPSS at 0.16% (6th percentile) reflects the very low probability of automated or widespread exploitation, consistent with the niche nature of this Perl CPAN module. No CISA KEV listing and no known POC further reinforce that this is not currently being actively exploited. Real-world risk is constrained to multi-user Linux/Unix systems where the targeted application uses this specific module and stores sensitive data in the shared segment; cloud-native or containerized single-tenant deployments are largely unaffected. The score is appropriate and there is no conflict between CVSS signals and the description - both point to a local, low-severity information disclosure with a limited but real scope-change consequence.

A local attacker with a standard unprivileged account on a multi-user Linux system identifies the file path used by Data::SortedSet::Shared in /tmp or /dev/shm. In the passive path, the attacker simply reads the world-readable 0644 backing file to extract IPC payloads after the legitimate process creates it. In the active path, the attacker plants a symlink at the expected file path before the application starts; because O_NOFOLLOW and O_EXCL are absent, the legitimate process follows the symlink or silently reuses the pre-planted file, granting the attacker full visibility into all data written to the shared segment. No public exploit code has been identified at time of analysis.