Data::Intern::Shared CVE-2026-65067

A low-privilege local account on the same host as a process using Data::Intern::Shared before 0.02 is required. The backing file must reside in a world-accessible directory such as /tmp or /dev/shm, which is the natural and intended location for shared IPC segments. For the passive information disclosure path, no race condition or special timing is needed - any local user can read the segment file directly as long as it exists. For the symlink or pre-creation attack, the attacker must plant the file or symlink at the expected path before the victim process first calls open(), introducing a local file-race requirement. Remote exploitation is not possible (AV:L). A non-default umask of 077 would partially reduce world-readability but is not a reliable control because the 0666 mode is hardcoded in intern.h. No authentication beyond a valid local OS account is required; the vulnerable behavior applies to any default installation.

The CVSS 3.1 base score of 3.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) accurately reflects the bounded scope: exploitation is strictly local, requires a low-privilege account, and the confidentiality impact is limited to IPC payload contents rather than system credentials. The Scope:Changed rating is appropriate because the attacker (a different user) crosses a process-isolation boundary to read another user's interned strings. EPSS at 0.16% (6th percentile) signals no observed exploitation activity, and the vulnerability is absent from the CISA KEV catalog. No public POC has been identified. Real-world risk is low in most deployments but materially elevated in multi-tenant environments - shared hosting, containers with a common /tmp, or HPC clusters - where untrusted local users cohabit with processes handling sensitive IPC data. In isolated single-user or properly namespaced environments, practical risk is negligible. The convergence of a low CVSS score, very low EPSS, no KEV listing, and niche product footprint places this firmly in the patch-at-next-maintenance-window category for most organizations.

A low-privileged local user on a shared host monitors /tmp or /dev/shm for the predictable path of a Data::Intern::Shared backing file, then simply opens and reads it - no race condition required - because the file is created world-readable (mode 0644). Alternatively, the attacker pre-plants a symlink at the expected path before the victim process starts, exploiting the missing O_NOFOLLOW to redirect the open() to an attacker-controlled file; no public POC exists but the attack requires only standard POSIX file operations available to any local user account.