Data::SpatialHash::Shared CVE-2026-65068

Exploitation requires a local, low-privileged user account on the same system as a process using Data::SpatialHash::Shared before version 0.02. The shared segment must be located in a directory accessible to the attacker, such as /tmp or /dev/shm - the typical deployment pattern for shared IPC. For passive eavesdropping (world-readable file), the attacker only needs to read the file after it is created, with no timing constraint. For the pre-creation attack (absent O_EXCL), the attacker must plant a file or symlink at the target path before the vulnerable process first opens it. For the symlink redirect (absent O_NOFOLLOW), the attacker must control the path entry before the open call. Single-user systems, containers with isolated /tmp namespaces, or deployments where the segment path is in a private directory (mode 0700) owned by the application user are not exploitable. Network-level access is not required; exploitation is local only.

The CVSS 3.1 base score of 3.8 (Low) accurately reflects the constrained real-world impact: attack vector is local (AV:L), privileges required are low (PR:L), and the confidentiality impact is limited (C:L). EPSS at 0.16% and the 6th percentile confirms negligible observed exploitation interest. The vulnerability is not listed in CISA KEV and no public proof-of-concept code has been identified. The S:C scope change in the vector is meaningful - a low-privileged local user can read IPC data belonging to a different, potentially more-privileged process - but this is bounded by the sensitivity of whatever data the target application stores in the shared segment. In practice, risk is concentrated in multi-tenant or shared-hosting Linux environments where untrusted local users coexist with applications using this module. Single-user systems and containerized deployments with isolated namespaces are largely unaffected. No conflicting signals between data sources; CVSS, EPSS, and KEV absence all converge on low real-world priority.

A local attacker on a multi-user system identifies that a target application uses Data::SpatialHash::Shared and determines the expected mmap backing file path (e.g., /tmp/sphash_<name>). Before the target process initializes, the attacker plants a symlink at that path pointing to a file they control or simply waits for the world-readable segment to be created, then reads the mmap backing file directly to extract IPC payloads being exchanged between the target process and its peers. No public exploit code has been identified.