Data::RadixTree::Shared CVE-2026-65063

A local user account on the same host as a process using Data::RadixTree::Shared before 0.02 is required; the CVSS vector PR:L confirms a low-privileged (but authenticated) local account is sufficient. The backing file must be created in a world-accessible directory - /tmp or /dev/shm, which are the module's intended locations for shared segments. The passive information-disclosure path (reading the 0644 backing file) requires no special timing and is exploitable as long as the victim process has the segment open. The symlink and pre-creation race paths require the attacker to plant a file or symlink at the exact expected path before the victim process calls open(), introducing a timing dependency that reduces but does not eliminate viability. Exploitation is limited to multi-user systems: single-user workstations, containers without additional shell-access users, or Kubernetes pods with a single service account are not exposed to cross-user access.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N and score of 3.8 accurately characterize the vulnerability: local access with standard user privileges, low complexity for the passive read path, and a scope change justified by the IPC segment crossing process boundaries. The Scope:Changed rating is appropriate because the world-readable segment exposes data produced by other processes on the system. EPSS at 0.16% (6th percentile) confirms this is not a focus of current threat actor activity, and the vulnerability is not listed in CISA KEV. No public exploit code has been identified. The real-world risk is meaningfully elevated in multi-user UNIX environments - shared hosting, HPC clusters, application servers - where untrusted local users coexist with privileged processes using this module. On single-user workstations, containers with no additional shell users, or Kubernetes pods with a single service account, the attack surface is effectively absent. The passive read path (simply reading the world-readable backing file) requires no timing precision and is more reliable than the race-condition pre-creation or symlink-planting paths, which depend on winning a timing window. Overall this is a genuine but narrow local information-disclosure risk, not a remote or unauthenticated threat.

A low-privileged local user on a shared Linux server identifies a long-running Perl service that uses Data::RadixTree::Shared before 0.02, locates the world-readable mmap backing file in /tmp or /dev/shm using standard ls or find commands, and reads its contents directly - exposing IPC payloads such as session state, tokens, or application data exchanged between service processes. Alternatively, the attacker pre-plants a symlink at the expected backing file path before the service starts, causing the vulnerable open() call to follow it and mmap over an attacker-chosen destination, potentially redirecting or reading traffic from a different file. No public exploit code is identified at time of analysis.