Data::SpatialHash::Shared writes a shared memory segment to a file created with mode 0666 and without O_NOFOLLOW or O_EXCL. This results in a world‑readable file that can be accessed by any local user. A local attacker can also place a symbolic link or precreate a file at the expected location, causing the program to open that target instead of the intended backing file. The consequence is that the attacker can read the contents of the shared memory region, potentially disclosing sensitive information stored there.

The flaw exists in all releases of Data::SpatialHash::Shared distributed by EGOR before version 0.02. Perl applications that import this module and use its shared storage feature are affected. No other products or vendors are listed as impacted.

The CVSS score is 3.8, indicating a low to medium severity. The EPSS score of less than 1% suggests that exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires local user access and an active race or symlink attack, so only users who have write or execution privileges on the directories where the backing file is created can exploit the issue. Under normal circumstances, the risk is the potential for local confidentiality compromise rather than remote or privileged escalation.