Data::NDArray::Shared before version 0.02 creates a memory‑mapped file with mode 0666 and opens it without O_EXCL or O_NOFOLLOW. The resulting backing file is world‑readable and, if a symlink or a pre‑existing file occupies the path, a local attacker can read or redirect the directories such as /tmp or /dev/shm, which are accessible to any local user, thus exposing potentially sensitive data that should be confined to the owning process.

Vendor EGOR provides Data::NDArray::Shared, and any installation of this module that is older than version 0.02—i.e., 0.01 or any release before 0.02—is affected.

The CVSS score of 3.3, the EPSS score of < 1%, and the fact that the vulnerability is not listed in the CISA KEV catalog indicate a low probability of exploitation. The likely attack vector is local, inferred from the fact that the flaw involves creating a file in a shared directory such as /tmp or /dev/shm that any local user can access; an attacker therefore needs the ability to place a file or symlink at the expected path. The lack of O_NOFOLLOW and O_EXCL allows the attacker to bypass the expected creation semantics and read or overwrite the backing file from this flaw.