EUVD-2026-46378
GHSA-g774-r9mw-4c65
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local attack vector, low complexity, low privileges; only confidentiality impact (information disclosure).
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
4DescriptionCVE.org
Data::RoaringBitmap::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW.
The segment is created in roaring.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing.
A "Shared" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted file or symlink at the path lets a local attacker win a pre-creation race or redirect the open.
AnalysisAI
Information disclosure in Data::RoaringBitmap::Shared Perl module before 0.02 allows local attackers to read sensitive IPC payloads from world-readable mmap backing files. The module creates files with insecure permissions in shared directories, while missing O_NOFOLLOW and O_EXCL flags enable symlink and race attacks. No active exploitation or public exploit code is known, and the EPSS score is low.
Technical ContextAI
Data::RoaringBitmap::Shared is a Perl module that provides shared-memory segments for roaring bitmaps, commonly stored in world-writable directories like /tmp or /dev/shm. The vulnerability stems from CWE-732: the roaring.h source opens the backing file using open(path, O_RDWR|O_CREAT, 0666), which under default umask creates a world-readable file (mode 0644). Additionally, the open call lacks O_NOFOLLOW, so symlinks are followed, and lacks O_EXCL, allowing a pre-existing file to be silently reused instead of failing. This design flaw exposes the shared IPC data to any local user who can place a symlink or file before the segment is created.
RemediationAI
Upgrade to Data::RoaringBitmap::Shared version 0.02, which resolves the issue. The vendor-released patch modifies the file creation flags and permissions in roaring.h (see the diff at https://metacpan.org/release/EGOR/Data-RoaringBitmap-Shared-0.02/diff/EGOR/Data-RoaringBitmap-Shared-0.01#roaring.h). If immediate patching is not possible, ensure the directory used for shared segments is not world-writable (e.g., avoid /tmp or /dev/shm) and restrict access to the application's private directory with appropriate permissions; note this may change application design and could break functionality relying on default shared locations.
The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginni
Stack buffer overflow in the Perl module Data::RingBuffer::Shared before 0.04 lets a local peer with write access to the
Out-of-bounds read and write in the Perl module Data::DisjointSet::Shared before version 0.02 lets a local actor who can
Out-of-bounds memory disclosure in Data::Intern::Shared before 0.02, a Perl shared-memory string interning module, lets
Out-of-bounds read and write in the Perl module Data::SpatialHash::Shared before 0.02 lets a local peer with write acces
Entropy source compromise in Data::Entropy (Perl) before version 0.010 allows any on-path network attacker to fully cont
Out-of-bounds read in Data::RoaringBitmap::Shared before version 0.02 for Perl allows a local peer with write access to
World-readable mmap backing files and absent O_NOFOLLOW protection in Data::Buffer::Shared for Perl (versions before 0.0
Insecure mmap backing-file creation in Data::DisjointSet::Shared (Perl/CPAN) before 0.02 exposes inter-process IPC paylo
Information disclosure in the Perl Data::Deque::Shared module before version 0.06 exposes inter-process communication qu
World-readable IPC segment exposure in Data::SpatialHash::Shared (Perl) before version 0.02 allows any local user on a m
Insecure file creation in Data::Intern::Shared for Perl (all versions before 0.02) exposes shared memory IPC payloads to
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today