Data::HashMap::Shared CVE-2026-65064

Exploitation requires a local unprivileged user account (PR:L) on the same system as a process actively using Data::HashMap::Shared for shared-memory IPC. The vulnerable code path is triggered whenever the module initializes a shared segment in a world-accessible directory such as /tmp or /dev/shm - this is the module's default and expected usage pattern, not a non-default configuration. The primary information-disclosure vector (reading the world-readable file) imposes no race condition and is reliable as long as the target process is running or has run and left the file in place. The symlink/pre-creation redirect variant requires the attacker to act before the target process first creates the segment (a timing race or persistent symlink in /tmp). Exploitation is limited to: (1) multi-user systems where untrusted local users share the same OS instance; (2) deployments where the Perl application actively uses this specific module for IPC; (3) cases where the module writes sensitive data to the shared segment. Containerized single-user deployments or systems where all local users are equivalently trusted are not at meaningful risk.

The overall real-world risk is low-to-moderate for multi-user deployments and negligible for single-user or containerized environments. CVSS 3.8 with AV:L/AC:L/PR:L/UI:N/S:C/C:L correctly captures a local, low-complexity, low-privilege attack with a scope change reflecting cross-process IPC boundary violation, but the limited confidentiality impact (C:L) and absence of integrity or availability impact keeps the base score modest. EPSS of 0.16% at the 6th percentile corroborates low exploitation likelihood - this is a niche Perl module with limited deployment footprint. There is no CISA KEV listing and no public exploit code identified at time of analysis. The world-readable file disclosure vector (Path 1) requires no race condition and is the most reliable attack, while the symlink/pre-creation race (Path 2) adds complexity. These signals are consistent: the vulnerability is real and technically straightforward, but the affected product's narrow footprint sharply limits the population at risk. Priority should be elevated only for multi-tenant systems where multiple users share access and the module is actively used for IPC.

A local unprivileged user on a multi-tenant Linux system (shared hosting, HPC cluster, developer workstation) identifies the predictable mmap backing file path created by a privileged or other-user process using Data::HashMap::Shared in /tmp or /dev/shm. Because the file is created world-readable (0644), the attacker directly opens and reads the file to extract IPC payloads - no timing race required. Alternatively, if the attacker acts before the target process starts, they can pre-plant a symlink at the expected path; because O_NOFOLLOW and O_EXCL are absent, the target process silently opens the attacker-controlled destination, potentially redirecting writes. No public exploit code has been identified.