Data::PubSub::Shared EUVD-2026-46373

Exploitation requires a local OS account with at least low-level privileges (PR:L per CVSS vector) on a host running an application that uses Data::PubSub::Shared version 0.06 or earlier. The application must have created its mmap backing file in a world-accessible directory such as /tmp or /dev/shm - which is the natural and documented placement for 'Shared' segments. The passive eavesdropping path (reading the world-readable file) requires no race and no special timing. The active pre-creation or symlink-redirect path additionally requires that the attacker be able to write to the shared directory and act before the legitimate application process starts. Exploitation is limited to the local machine only (AV:L); remote, unauthenticated, or network-based exploitation is not possible. Deployments that mount private per-user /tmp directories (e.g., via pam_namespace) or that run the application in a dedicated single-user container with no co-tenant processes are not realistically at risk.

The NVD-assigned CVSS 3.1 score of 3.8 (Low) with vector AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N accurately reflects the bounded real-world impact: exploitation is strictly local, requires only a low-privileged OS account, and yields only partial confidentiality loss. The scope-changed flag (S:C) is notable because the attacker reads data belonging to other processes, crossing security boundaries within the host. EPSS at 0.16% (6th percentile) corroborates the low exploitation likelihood - this is an obscure Perl CPAN module with minimal enterprise footprint. There is no CISA KEV listing and no known public exploit code. The primary risk is insider threat or privilege escalation assistance on multi-tenant Linux hosts (shared hosting, container escape scenarios with a shared /tmp mount). The world-readable passive read path (no race required) is more reliable and lower-complexity than the symlink/pre-creation path; AC:L in the CVSS vector reflects this easier variant. Overall, this is a genuine but low-severity finding best addressed through standard patch application rather than emergency triage.

A local user on a multi-tenant Linux host where a Perl application uses Data::PubSub::Shared simply opens and reads the mmap backing file in /tmp (e.g., /tmp/pubsub.shm) after it has been created, recovering whatever IPC messages other processes have written - no race condition required, as the file is world-readable by default. For a more targeted attack, the adversary pre-plants a symlink at the expected segment path before the Perl application starts; because O_EXCL is absent, the application silently opens the attacker-controlled destination, allowing the attacker to redirect shared-memory writes to an arbitrary world-accessible location.