CVE-2026-64613 Details
Description
Data::Buffer::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without O_NOFOLLOW. The segment is created in buf_generic.h with open(path, O_RDWR|O_CREAT|O_EXCL, 0666). O_EXCL blocks a pre-seeded file on create, but the mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable), and O_NOFOLLOW is absent, so a symlink planted at the path is followed when the segment is attached. A "Shared" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted symlink at the path redirects the open to another file.
A vulnerability exists in Data::Buffer::Shared for Perl, specifically in versions prior to 0.05. The issue arises because the library creates a world-readable memory-mapped backing file and opens it without the O_NOFOLLOW option. The vulnerable segment is generated in buf_generic.h, where the file is created with read and write permissions for everyone. Although the O_EXCL flag prevents overwriting an existing file, the permission mode allows the file to be world-readable under the default umask. The absence of O_NOFOLLOW means that a symlink placed at the file path can be followed, potentially leading to unauthorized access or manipulation of data.
Users can upgrade to Data::Buffer::Shared version 0.05 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 21, 2026CISA-ADP
Assessed Jul 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://metacpan.org/release/EGOR/Data-Buffer-Shared-0.05/changes | CPANSec | Vendor |
| https://metacpan.org/release/EGOR/Data-Buffer-Shared-0.05/diff/EGOR/Data-Buffer-Shared-0.04#buf_generic.h | CPANSec | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | CPANSec |
| CWE-732 | Incorrect Permission Assignment for Critical Resource | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| Data::Buffer::Shared | < 0.05 |
CPE
Remediation
| |
| Data::Buffer::Shared::F32 | < 0.05 |
CPE
Remediation
| |
| Data::Buffer::Shared::F64 | < 0.05 |
CPE
Remediation
| |
| Data::Buffer::Shared::I16 | < 0.05 |
CPE
Remediation
| |
| Data::Buffer::Shared::I32 | < 0.05 |
CPE
Remediation
| |
| Data::Buffer::Shared::I64 | < 0.05 |
CPE
Remediation
| |
| Data::Buffer::Shared::I8 | < 0.05 |
CPE
Remediation
| |
| Data::Buffer::Shared::Str | < 0.05 |
CPE
Remediation
| |
| Data::Buffer::Shared::U16 | < 0.05 |
CPE
Remediation
| |
| Data::Buffer::Shared::U32 | < 0.05 |
CPE
Remediation
| |
| Data::Buffer::Shared::U64 | < 0.05 |
CPE
Remediation
| |
| Data::Buffer::Shared::U8 | < 0.05 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Modified | CISA-ADP |
| Jul 21, 2026 | New CVE Received | CPANSec |