PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-64615 EGOR CVE debrief

CVE-2026-64615 is a vulnerability in Data::Graph::Shared versions before 0.04 for Perl, allowing local attackers to read IPC payloads. The package creates a world-readable mmap backing file and opens it without O_EXCL or O_NOFOLLOW. Users should update to version 0.04 or later and implement defensive measures. Affected systems may have exposed IPC payloads readable by local users. The vulnerability was reported with limited source detail, so defenders should verify affected product deployments, review official advisories, and track exceptions.

Vendor
EGOR
Product
Data::Graph::Shared
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-07-22
Advisory published
2026-07-21
Advisory updated
2026-07-22

Who should care

Users of Data::Graph::Shared versions before 0.04 for Perl should be aware of this vulnerability and take necessary actions to prevent exploitation. This includes updating to version 0.04 or later, implementing defensive measures such as using O_EXCL and O_NOFOLLOW when opening the file, and changing the file mode to prevent world-readability. Affected operators, platforms, vulnerability-management teams, and security teams should review compensating controls for exposed systems while remediation is scheduled and verified.

Technical summary

The vulnerability is caused by Data::Graph::Shared versions before 0.04 for Perl creating a world-readable mmap backing file and opening it without O_EXCL or O_NOFOLLOW. The segment is created in graph.h with open(path, O_RDWR|O_CREAT, 0666), resulting in a world-readable file mode of 0644 under the default umask 022. This allows a local attacker to read IPC payloads stored in the segment. A pre-planted file or symlink at the path lets a local attacker win a pre-creation race or redirect the open.

Defensive priority

High

Recommended defensive actions

  • Update to version 0.04 or later
  • Use O_EXCL and O_NOFOLLOW when opening the file
  • Change the file mode to prevent world-readability
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was reported in the NVD database with limited source detail. CVE-2026-64615 was published on 2026-07-21T20:17:04.187Z and modified on 2026-07-22T16:21:53.517Z. Evidence is limited to CVE and NVD records. Defenders should verify affected product deployments, review official advisories, and track exceptions.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T20:17:04.187Z and has not been modified since then.