The vulnerability in Data::HashMap::Shared (CVE-2026-65064) arises from the creation of a shared memory segment file with overly permissive file permissions (mode 0644) and the absence of O_EXCL and O_NOFOLLOW flags during file open operations. This allows local attackers to read sensitive IPC data stored in the world-readable segment and to exploit race conditions or symlink redirections by pre-creating or linking files in shared directories such as /tmp or /dev/shm. The issue is due to incorrect permission assignment (CWE-732) and improper symbolic link handling (CWE-59).

Local attackers with low privileges can read inter-process communication payloads that should be protected, potentially leading to information disclosure. The vulnerability does not affect integrity or availability but compromises confidentiality of data shared via the affected memory-mapped files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using vulnerable versions of Data::HashMap::Shared in environments where untrusted local users have access to shared directories. Consider restricting permissions on shared memory files and monitoring for suspicious symlink or file creation in shared directories.