CVE-2026-64616 in Data::NDArray::Shared
Summary
by MITRE • 07/21/2026
Data::NDArray::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW.
The segment is created in ndarray.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing.
A "Shared" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted file or symlink at the path lets a local attacker win a pre-creation race or redirect the open.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/21/2026
The vulnerability in Data::NDArray::Shared versions before 0.02 represents a critical security flaw that exposes shared memory segments to unauthorized access through improper file handling practices. This issue stems from the implementation of memory mapping operations within the ndarray.h file where the open() system call is invoked with insufficient security parameters. The core technical problem manifests when the library creates backing files using open(path, O_RDWR|O_CREAT, 0666) which establishes world-readable permissions by default, creating a significant attack surface for local privilege escalation and information disclosure.
The flaw operates through multiple vectors that compound the security risk within shared memory contexts. The file mode 0666 combined with typical umask values of 022 results in 0644 permissions, making the backing files accessible to all local users. The absence of O_NOFOLLOW flag creates a symbolic link attack vector where malicious actors can plant symlinks at intended file locations, causing the application to open unintended targets. Additionally, the lack of O_EXCL prevents proper error handling when attempting to create new files, allowing attackers to pre-place malicious files that will be silently opened instead of failing as expected.
This vulnerability directly maps to CWE-732 and CWE-377, representing inadequate file permissions and insecure temporary file creation respectively. The operational impact extends beyond simple information disclosure to enable privilege escalation scenarios where local attackers can access sensitive data stored in shared memory segments. Attackers leveraging this vulnerability can exploit race conditions in pre-creation phases or redirect file operations through symbolic links to gain unauthorized access to IPC payloads. The attack vector is particularly dangerous in environments where /tmp or /dev/shm directories are used for shared memory segments, as these locations typically lack proper access controls and are accessible to all local users.
The implications of this vulnerability align with ATT&CK technique T1068 which covers "Local Privilege Escalation" and T1059 which addresses "Command and Scripting Interpreter" through exploitation of insecure file handling. Mitigation strategies should focus on implementing proper file creation semantics with O_EXCL flag to prevent race conditions, adding O_NOFOLLOW to prevent symlink redirection, and using appropriate file permissions that restrict access to authorized processes only. System administrators should also consider restricting access to shared memory directories or implementing more secure temporary file creation mechanisms. The vulnerability demonstrates the critical importance of proper file descriptor management in shared memory implementations and highlights the need for security-conscious development practices when handling inter-process communication mechanisms.