The vulnerability in Data::RoaringBitmap::Shared (CVE-2026-65065) arises from incorrect permission assignment and unsafe file opening practices. Specifically, the mmap backing file is created with mode 0666, which after applying the default umask 022 results in a world-readable file (mode 0644). The open call does not use O_EXCL, allowing it to open an existing file silently, and lacks O_NOFOLLOW, enabling symlink traversal. Since the shared segment resides in a shared directory accessible by local users, this permits local attackers to read IPC payloads or exploit pre-creation race conditions by planting files or symlinks at the target path.

Local users can read sensitive inter-process communication (IPC) data stored in the world-readable mmap backing file. They can also exploit the absence of O_EXCL and O_NOFOLLOW flags to perform pre-creation race attacks or redirect file operations via symlinks, potentially leading to unauthorized data disclosure or manipulation of the shared resource.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid running Data::RoaringBitmap::Shared in environments where untrusted local users have access to the shared directory paths used for the mmap backing file. Monitor vendor communications for patches that address file permission settings and the use of safe open flags (O_EXCL and O_NOFOLLOW).