CVE-2026-64613 affects Data::Buffer::Shared versions prior to 0.05. The vulnerability is due to the creation of a memory-mapped backing file with permissions 0666 (resulting in 0644 after umask), making it world-readable. Additionally, the open call does not use the O_NOFOLLOW flag, allowing an attacker to plant a symlink at the file path. This can cause the process to open an unintended file, potentially exposing sensitive IPC data to unauthorized local users. The issue stems from CWE-732 (Incorrect Permission Assignment for Critical Resource) and CWE-59 (Improper Link Resolution).

Local attackers can read sensitive inter-process communication (IPC) data stored in the world-readable shared memory segment. They may also exploit the lack of O_NOFOLLOW to redirect file operations to arbitrary files via symlinks, potentially exposing or leaking critical information. The vulnerability does not allow modification or denial of service but compromises confidentiality of IPC data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid running vulnerable versions in environments where untrusted local users have access to shared directories like /tmp or /dev/shm. Restricting permissions on shared directories and monitoring for suspicious symlinks may reduce risk.