Data::Deque::Shared versions before 0.06 create a world-readable mmap backing file with mode 0644 in shared directories such as /tmp or /dev/shm. The file is opened without O_EXCL or O_NOFOLLOW, so a local attacker who can create a symlink or pre‑create a file at the path can redirect or pre‑create the mmap usage. This allows the attacker to read the contents of the RAM‑backed segment and potentially influence its contents, leading to information disclosure and unauthorized modification of IPC data.

The affected product is EGOR Data::Deque::Shared, versions earlier than 0.06. No specific sub‑version numbers are listed beyond the pre‑0.06 boundary. The issue affects any install that uses the module on systems where /tmp or /dev/shm is mounted with world‑readable defaults.

The CVSS score is 3.8, reflecting modest risk. The EPSS indicates a very low probability of exploitation (<1%). The vulnerability is not listed in the CISA KEV catalog. The attack vector is local: a user with the ability to write to the shared directory or create symlinks can exploit the missing O_NOFOLLOW and O_EXCL flags. Given the low exploitation likelihood and to local users on the same host.