The vulnerability in Data::DisjointSet::Shared (CVE-2026-65069) arises from incorrect permission assignment and insecure file opening practices. Specifically, the mmap backing file is created with mode 0666, which under typical umask settings results in a world-readable file (0644). Additionally, the open call does not use O_EXCL or O_NOFOLLOW flags, allowing an attacker to exploit symlink following and pre-creation race conditions. Since the shared segment resides in directories accessible by local users (e.g., /tmp or /dev/shm), this can lead to unauthorized local users reading IPC payloads stored in the segment. The vulnerability is present in versions before 0.02 of Data::DisjointSet::Shared for Perl.

Local attackers can read sensitive IPC payloads by exploiting the world-readable mmap backing file and symlink race conditions. This compromises confidentiality but does not affect integrity or availability. The vulnerability requires local access and does not allow privilege escalation or remote exploitation.

No official fix or patch is currently available for this vulnerability. Users should avoid using affected versions prior to 0.02. If possible, restrict local user access to shared directories like /tmp or /dev/shm or use alternative IPC mechanisms with secure file permissions and proper open flags (O_EXCL and O_NOFOLLOW). Monitor vendor advisories for updates or patches addressing this issue.