The vulnerability in Data::Deque::Shared (versions before 0.06) arises from creating a mmap backing file with mode 0666, which under typical umask settings results in a world-readable file (0644). The file is opened without O_EXCL or O_NOFOLLOW flags, enabling attackers to exploit pre-creation race conditions or symlink redirection. Because the shared segment resides in directories accessible by local users (e.g., /tmp, /dev/shm), any local user can read the IPC payloads stored in the segment. This leads to exposure of potentially sensitive inter-process communication data due to incorrect permission assignment and unsafe file handling.

Local users can read sensitive IPC payloads stored in the shared memory segment due to world-readable file permissions. Additionally, attackers can exploit race conditions or symlink redirection to manipulate the file opened by the application. The impact is limited to confidentiality loss of IPC data with no direct integrity or availability impact reported. The CVSS score is 3.8 (low), reflecting limited impact and local attack vector with low privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid running vulnerable versions in environments where untrusted local users have access to shared directories like /tmp or /dev/shm. Consider manually restricting permissions on the mmap backing file or using alternative IPC mechanisms that enforce stricter file permissions and safe file opening flags (O_EXCL, O_NOFOLLOW).