Is CVE-2026-64615 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-64615 being exploited in the wild.

How severe is CVE-2026-64615?

Informational severity, with a CVSS score of 4, published 21 July 2026.

Which products and versions are affected?

EGOR Data Graph::Shared < 0.04.

Is there a fix for CVE-2026-64615?

A patch was published on 2026-07-03: Version 0.04 released with security hardening. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-64615 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-64615?

Check whether you run EGOR Data Graph::Shared at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-64615: EGOR Data::Graph::Shared insecure file permissions and symlink following

Q: Is there a fix for CVE-2026-64615?

A patch was published on 2026-07-03: Version 0.04 released with security hardening. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-64615 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-64615?

Check whether you run EGOR Data Graph::Shared at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-64615 · Severity: info · CVSS 4 · Published 2026-07-21

Data::Graph::Shared is a Perl library used for managing shared data structures. A security flaw in versions before 0.04 allows local users on the same system to read sensitive data stored in these shared structures. Additionally, a local attacker could trick the library into writing data to the wrong location or hijacking the data stream, potentially leading to data theft or corruption.

Vendors: EGOR Data.

Quick answers

Is CVE-2026-64615 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-64615 being exploited in the wild.
How severe is CVE-2026-64615?: Informational severity, with a CVSS score of 4, published 21 July 2026.
Which products and versions are affected?: EGOR Data Graph::Shared < 0.04.
Is there a fix for CVE-2026-64615?: A patch was published on 2026-07-03: Version 0.04 released with security hardening. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-64615 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-64615?: Check whether you run EGOR Data Graph::Shared at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in graph.h where the open() system call is used with O_RDWR|O_CREAT and a mode of 0666. Due to default umask settings (typically 022), this results in world-readable files (0644) in shared directories like /tmp or /dev/shm, allowing local information disclosure of IPC payloads. Furthermore, the absence of O_NOFOLLOW and O_EXCL flags allows a local attacker to perform a symlink attack or win a race condition to pre-plant a file, potentially redirecting file operations or gaining unauthorized access to the shared memory segment. The issue is fixed in version 0.04 by using mode 0600 and improved file handling.

Affected products

EGOR Data::Graph::Shared < 0.04

Timeline

2026-07-03: patched: Version 0.04 released with security hardening.
2026-07-21: disclosed: CVE-2026-64615 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.