The vulnerability is a buffer overwrite flaw in the Zstandard (zstd) library embedded within Sereal::Decoder. A race condition in the one‑pass compression functions of zstd prior to version 1.3.8 permits an attacker to write bytes beyond the allocated output buffer when a smaller-than‑recommended buffer is used. This overflow can corrupt memory and potentially allow arbitrary code execution or other severe compromise. The flaw maps to CWE‑1395.

The affected component is Sereal::Decoder from the YVES vendor, in versions 4.000 through 4.009_002 for Perl. Users deploying these releases are susceptible to the buffer overflow unless they upgrade to the patched version 4.010 or later.

The CVSS score of 8.1 indicates high severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog, which implies no proven large‑scale exploitation yet. The likely attack vector is the ability of an attacker to supply malicious serialized data that triggers the overflow, a scenario that requires remote or local access to the application using Sereal::Decoder. The combination of high impact and low exploitation likelihood points to a medium but non‑negligible risk that can be mitigated by timely patching.