Data::RingBuffer::Shared CVE-2026-65066

Exploitation requires a local user account on the same host as a process using Data::RingBuffer::Shared before 0.04, and the module must be actively in use (i.e., a process has created and is writing to the shared ring buffer segment). The shared segment must reside in a world-accessible directory such as /tmp or /dev/shm, which is the module's intended deployment pattern for 'Shared' segments. For the direct information disclosure path, no race condition or special timing is required - the attacker simply reads the existing 0644-mode backing file. For the pre-creation or symlink redirect attacks, the attacker must be able to write to the backing file directory before the target process initializes the segment. Remote exploitation is not possible (AV:L); root or elevated privilege is not required. Exploitation is limited to environments where untrusted local users share the same host as processes exchanging sensitive data through this IPC mechanism.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N (score 3.8) accurately reflects the attack profile: local access with low privilege, yielding limited confidentiality impact with scope change. The scope change (S:C) is justified because the permissioning flaw in the module exposes data owned by separate, potentially higher-privileged processes. The EPSS of 0.16% at the 6th percentile is consistent with real-world risk: this is a niche Perl CPAN module with a small enterprise footprint, no KEV listing, and no public POC. CVSS at 3.8 is an honest reflection - meaningful in multi-user shared systems (HPC clusters, shared application servers) where co-tenant local users could passively read sensitive IPC data without any race condition, but not broadly weaponizable or automatable. The symlink attack adds a secondary vector requiring timing but introduces no additional impact category beyond what the direct read already provides. This is a genuine but narrow-scope defect with real consequences only in multi-user deployment environments.

A local attacker on a shared multi-user system (such as an HPC node or shared application server) identifies the mmap backing file path used by a target process in /tmp or /dev/shm, then directly reads the world-readable 0644 file to extract all IPC payloads stored in the ring buffer without any race or privilege escalation. Alternatively, before the target process starts, the attacker plants a symlink at the expected path; the absence of O_NOFOLLOW causes the module to silently follow the link, redirecting the open to an attacker-controlled file and exposing or manipulating IPC data.