The vulnerability in Data::SortedSet::Shared (CVE-2026-65062) arises from the creation of a mmap backing file with mode 0666 (resulting in 0644 after umask) and the absence of O_EXCL and O_NOFOLLOW flags during file open operations. This leads to a world-readable file in shared directories, enabling local attackers to read IPC data and exploit race conditions or symlink redirections. The issue is due to incorrect permission assignment (CWE-732) and unsafe file handling (CWE-59).

Local attackers can read sensitive inter-process communication data stored in the world-readable mmap backing file. They can also exploit race conditions or symlink redirections to influence the file opened by the application, potentially leading to information disclosure or other local attacks. There is no indication of remote exploitation or impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid running the vulnerable versions in untrusted multi-user environments or restrict permissions on the shared directories and files manually to prevent unauthorized access and symlink attacks.