Is CVE-2026-64613 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-64613 being exploited in the wild.

How severe is CVE-2026-64613?

Informational severity, with a CVSS score of 3.3, published 21 July 2026.

Which products and versions are affected?

Vividsnow Data::Buffer::Shared before 0.05.

Is there a fix for CVE-2026-64613?

A patch was published on 2026-07-03: Version 0.05 released with security hardening. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-64613 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-64613?

Check whether you run Vividsnow Data::Buffer::Shared at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-64613: EGOR Data::Buffer::Shared insecure permissions and symlink following

CVE-2026-64613 · Severity: info · CVSS 3.3 · Published 2026-07-21

Data::Buffer::Shared is a Perl module used to manage shared memory buffers between different processes. A security flaw in versions before 0.05 allows local users on the same system to read sensitive data stored in these buffers or trick the application into accessing unintended files. This could lead to the exposure of private information or unauthorized modification of system files if the application is running with elevated privileges.

Vendors: Vividsnow.

Quick answers

Is CVE-2026-64613 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-64613 being exploited in the wild.
How severe is CVE-2026-64613?: Informational severity, with a CVSS score of 3.3, published 21 July 2026.
Which products and versions are affected?: Vividsnow Data::Buffer::Shared before 0.05.
Is there a fix for CVE-2026-64613?: A patch was published on 2026-07-03: Version 0.05 released with security hardening. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-64613 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-64613?: Check whether you run Vividsnow Data::Buffer::Shared at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in buf_generic.h where mmap backing files are created using open() with mode 0666. Due to default umask settings (typically 022), this results in world-readable files (0644) in shared directories like /tmp or /dev/shm, allowing any local user to read IPC payloads. Additionally, the absence of the O_NOFOLLOW flag during the open call allows an attacker to plant a symlink at the expected path, potentially causing the application to read from or write to an arbitrary file. The issue is addressed in version 0.05 by changing the default creation mode to 0600 and hardening file handling.

Affected products

EGOR (vividsnow) Data::Buffer::Shared before 0.05

Timeline

2026-07-03: patched: Version 0.05 released with security hardening.
2026-07-21: disclosed: CVE-2026-64613 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.