Data::RoaringBitmap::Shared CVE-2026-65065

Exploitation requires local low-privileged access to the system and the ability to place files or symlinks in the directory where the shared segment is created, which by default is a world-writable location like /tmp or /dev/shm. The vulnerability is exploitable as long as the application uses a Shared segment with the default configuration. No authentication beyond being a local user is needed, and no user interaction is required. The attack is limited to information disclosure; it does not allow code execution or system compromise beyond reading the segment contents.

The CVSS vector indicates a local attack vector, low complexity, and low privileges required, yielding a medium base score of 5.5. However, EPSS probability is only 0.16% (6th percentile), and the vulnerability is not listed in CISA KEV. No public proof-of-concept exploit or active exploitation has been identified. Using SSVC, exploitation is 'none', automatable is 'yes' given the ease of symlink planting, and technical impact is 'partial' (confidentiality only). The real-world risk is low due to the niche nature of the Perl module and lack of attacker activity, despite the CVSS score. CVSS suggests local access, which is accurate; no conflicting signals.

A local attacker with a shell account on the host creates a symlink in /dev/shm pointing to a file they can later read, or pre-creates a world-readable file at the expected path of the shared segment. When the vulnerable application starts and opens the mmap file, the attacker reads the exposed IPC data, potentially obtaining sensitive information passed between processes. The attack can be executed without user interaction and only requires the ability to write to the shared directory.