The vulnerability in Data::SortedSet::Shared (versions before 0.03) arises from creating a shared memory segment file with overly permissive permissions (mode 0666) and without using O_EXCL or O_NOFOLLOW flags in the open() call. This results in a world-readable mmap backing file that resides in shared directories like /tmp or /dev/shm. Because O_NOFOLLOW is not used, symlinks can be followed, and without O_EXCL, pre-existing files can be silently used, enabling local attackers to read IPC payloads or exploit race conditions by planting files or symlinks at the target path. This is classified under CWE-732 (Incorrect Permission Assignment) and CWE-59 (Improper Link Following).

Local users on the system can read sensitive inter-process communication (IPC) data stored in the shared memory segment due to world-readable permissions. Additionally, attackers can exploit race conditions or symlink redirection to manipulate the file opened by the application, potentially leading to unauthorized data access or local privilege escalation. The vulnerability affects local security boundaries and confidentiality of IPC data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to shared directories such as /tmp or /dev/shm to trusted users only. Avoid running vulnerable versions in multi-user environments where local users are untrusted. Monitor vendor channels for updates or official patches addressing this issue.