Data::HashMap::Shared modules before version 0.14 create a backing file for shared memory with mode 0666, making the file world-readable under a default umask of 022. The file is opened without O_EXCL or O_NOFOLLOW, allowing a local attacker to plant a symlink or pre-create a file at the backing-file path. These weaknesses correspond to CWE-59 and CWE-732. As a result, a local attacker can read the contents of the shared memory or interfere with the creation of the backing file, potentially exposing sensitive data held by the shared segment.

Any system running Perl applications that use the EGOR Data::HashMap::Shared module prior to version 0.14 is impacted. The vulnerability applies regardless of operating system, as the issue resides in the module's code, not the underlying OS. Scripts that import this module and create shared memory segments will inherit the risk unless upgraded.

With a CVSS score of 3.8 the vulnerability is considered low to moderate severity. The EPSS score of less than 1 % indicates rare exploitation. It is not listed in the CISA KEV catalog. The attack requires local privilege and the ability to run Perl code that imports Data::HashMap::Shared. Because the module creates a world-readable file in shared directories such as /tmp or /dev/shm, a local attacker can read sensitive data from the shared memory or modify the backing file if they control the directory. If the Perl process runs with elevated privileges, the impact could extend to system-wide data exposure.