CVE-2026-64617 EGOR CVE debrief

Who should care

Users of Data::PubSub::Shared versions before 0.07 for Perl should be aware of this vulnerability. Local users may be able to read the IPC payloads stored in the world-readable segment, and a local attacker may be able to win a pre-creation race or redirect the open. Operators, platform administrators, vulnerability management teams, and security teams should review and take necessary actions.

Technical summary

The vulnerability exists in the Data::PubSub::Shared package versions before 0.07 for Perl. The package creates a shared segment in a shared directory such as /tmp or /dev/shm with a world-readable mode. The open function is called without O_EXCL or O_NOFOLLOW flags, allowing a local attacker to plant a symlink at the path or use a pre-planted file. This could allow an attacker to access sensitive information.

Defensive priority

High

Recommended defensive actions

• Update to version 0.07 or later
• Use compensating controls such as access controls or file system permissions
• Monitor for suspicious activity
• Inventory and track usage of affected software
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record was published on 2026-07-21T20:17:04.403Z and was last modified on 2026-07-22T16:21:53.517Z. The NVD entry is currently Deferred. Evidence is limited to CVE and NVD information. Defenders should verify affected product deployments, review official advisories, and track usage.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.