The Data::RoaringBitmap::Shared Perl module prior to version 0.02 creates an mmap backing file with mode 0666, which, under the common default umask of 022, becomes world‑readable 0644. The open call omits both the O_EXCL flag, allowing a pre‑existing file to be silently reused, and the O_NOFOLLOW flag, permitting a symlink placed by an attacker at the expected path to be followed. Together, these flaws give any local user the ability to read or overwrite the bitmap data stored in the file, potentially revealing confidential information that the application intended to share only among privileged processes. The weakness is rooted in CWE‑59 (symbolic‑link race) and CWE‑732 (incorrect permission assignment for a critical resource).

Systems that load the Data::RoaringBitmap::Shared module by EGOR with a version earlier than 0.02 are affected. The module typically creates the backing file in a shared directory such as /tmp or /dev/shm, and the flaw exists across all operating systems that support Perl and POSIX file semantics. Only the pre‑0.02 releases are impacted; versions 0.02 and newer implement secure file creation by setting the file to mode 0600 and using the O_EXCL and O_NOFOLLOW flags.

The CVSS score is 5.5, indicating moderate complexity and confidentiality impact. The EPSS score is below 1 %, showing that the likelihood of exploitation is currently low. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires local filesystem access sufficient to plant a symlink or pre‑create a file at the module’s backing‑file path, limiting the attack surface to the local host. The primary consequence is a loss of confidentiality of the shared bitmap data; there is no capability for privilege escalation or remote code execution.