The vulnerability in Data::Graph::Shared (CVE-2026-64615) arises from the creation of a mmap backing file with mode 0666 (resulting in 0644 after umask) and opening it without O_EXCL or O_NOFOLLOW flags. This permits the file to be world-readable and vulnerable to symlink following and pre-creation race conditions. Since the shared segment resides in commonly accessible directories, local attackers can read sensitive IPC data or manipulate the file open operation to their advantage. The issue is classified under CWE-732 (Incorrect Permission Assignment for Critical Resource) and CWE-59 (Improper Link Resolution).

Local attackers with low privileges can read sensitive data from the shared memory segment due to world-readable permissions. They can also exploit the absence of O_NOFOLLOW and O_EXCL flags to perform symlink attacks or pre-creation races, potentially redirecting file operations. The vulnerability does not allow privilege escalation or denial of service but compromises confidentiality of IPC payloads.

No official patch or remediation level is currently documented. Users should avoid using affected versions prior to 0.04 or apply manual mitigations such as restricting directory permissions where the mmap file is created, ensuring the use of secure flags (O_EXCL and O_NOFOLLOW) when opening files, and avoiding placing shared segments in world-accessible directories. Monitor vendor advisories for updates or official fixes.