Executive brief
A Perl library used for sharing large bitmap data structures between processes contains a security flaw in how it handles temporary files. Because it creates these files with overly broad permissions and fails to verify if they are already tampered with, a local attacker on the same system could read sensitive data or hijack the communication between processes. This could lead to unauthorized data access or disruption of services relying on this library.
Technical details
The vulnerability exists in roaring.h where memory-mapped (mmap) backing files are created using open() with mode 0666 and without O_EXCL or O_NOFOLLOW flags. Under a default umask of 022, this results in world-readable files (0644) typically located in shared directories like /tmp or /dev/shm. A local attacker can exploit this to read IPC payloads or perform a symlink/race condition attack to redirect file operations or use a pre-planted file. The issue is addressed in version 0.02 by changing the default creation mode to 0600 and implementing better file handling.
Affected products
- EGOR (vividsnow) Data::RoaringBitmap::Shared before 0.02
Timeline
- 2026-07-03: patched: Version 0.02 released with security hardening.
- 2026-07-21: disclosed: CVE-2026-65065 published.