CVE-2026-65068 EGOR CVE debrief

Who should care

Users of Data::SpatialHash::Shared versions before 0.02 for Perl should be aware of this vulnerability. Affected operators, platforms, vulnerability-management, and security teams should review the CVE record and NVD detail to understand the affected scope, severity, and vendor guidance.

Technical summary

The vulnerability exists due to the creation of a world-readable mmap backing file in sphash.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing. This allows local users to access the IPC payloads stored in the world-readable segment.

Defensive priority

High

Recommended defensive actions

• Update to version 0.02 or later
• Restrict access to the mmap backing file
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-21T20:17:05.837Z and last modified on 2026-07-22T16:21:53.517Z. The evidence is limited to the information provided in the CVE record and NVD detail. Defenders should verify the affected scope, severity, and vendor guidance. The CVE record and NVD detail provide the most up-to-date information on this vulnerability.

Official resources