Data::Buffer::Shared EUVD-2026-46369

Exploitation requires an established local user session on the target host - no network-based attack path exists. The target application must be actively using Data::Buffer::Shared for IPC, with the shared segment backed by a file in a world-writable directory such as /tmp or /dev/shm. For the passive disclosure attack, no race condition or special timing is required: the attacker simply reads the world-readable mmap file while the segment is live, and any unprivileged local user can do so. For the symlink attack, the attacker must predict the segment file path and plant the symlink before the target process calls attach (introducing a race); this limits opportunistic exploitation but does not prevent a determined local attacker with knowledge of the application's segment naming. Exploitation is bounded entirely by local access and the presence of this specific CPAN module in the running application's dependency tree.

The NVD CVSS 3.1 vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N scores 6.2 (Medium). The local attack vector is the dominant risk-limiting factor - network-based exploitation is impossible, and an attacker must already hold a local shell on the target. EPSS at 0.16% (6th percentile) confirms very low observed exploitation interest, consistent with the niche footprint of a Perl CPAN IPC library. The vulnerability is absent from CISA KEV and no proof-of-concept has been identified. The AC:L rating is accurate for the passive disclosure path (simply reading the world-readable file requires no race or complexity), though the symlink attack introduces an implicit race condition not fully captured by AC:L - this is a minor internal tension in the NVD vector but not a material discrepancy given the low overall severity. The confidentiality impact (C:H) is legitimate: IPC payloads may carry session tokens, credentials, or sensitive application data. For Perl applications actively using this module on multi-user systems, the risk is real and the fix is trivially applied; for all other environments, this vulnerability is negligible.

A local attacker sharing a multi-user host with a Perl application that uses Data::Buffer::Shared for IPC navigates to /tmp or /dev/shm, identifies the mmap backing file by its naming convention, and reads its contents using standard tools (cat, dd, or a trivial Perl or Python script), extracting whatever IPC payloads - potentially session data, credentials, or application state - are currently stored in the segment. In the symlink variant, the attacker predicts the segment path before the target process attaches, plants a symlink pointing to a target file such as /etc/shadow or an application secrets file, and waits for the attach to redirect the open call. No public exploit code exists at time of analysis.