The vulnerability in Data::PubSub::Shared (CVE-2026-64617) arises from incorrect permission assignment and unsafe file opening practices in versions prior to 0.07. Specifically, the mmap backing file is created with mode 0666 (resulting in world-readable files under typical umask settings) and opened without O_EXCL or O_NOFOLLOW flags. This allows local attackers to read sensitive IPC data and exploit race conditions or symlink redirection attacks by pre-creating files or symlinks in shared directories. The issue is categorized under CWE-732 (Incorrect Permission Assignment for Critical Resource) and CWE-59 (Improper Link Resolution).

Local users on the system can read inter-process communication payloads stored in the world-readable shared memory segment, potentially exposing sensitive data. Additionally, attackers can exploit race conditions or symlink redirection to manipulate the file open operation, possibly leading to unauthorized file access or modification. There is no indication of remote exploitation or known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid running vulnerable versions (<0.07) in environments where untrusted local users have access to shared directories such as /tmp or /dev/shm. Consider restricting permissions on the shared directory or using alternative IPC mechanisms that enforce stricter access controls.