Sereal::Decoder embeds an older Zstandard library that is vulnerable to a race condition in its one-pass compression functions. The flaw can cause out-of-bounds writes when an output buffer smaller than recommended is used, potentially allowing an attacker to corrupt memory and execute arbitrary code. This weakness is reflected in CWE‑1395 and CWE‑787, indicating a race condition leading to an out-of-bounds write.

Sereal::Decoder versions 4.000 through 4.009_002 for Perl, distributed by vendor Yves. Any Perl environment that imports this decoder in those versions is potentially affected. Upgrading to version 4.010 or later removes the vulnerable Zstandard code.

The CVSS score of 8.1 indicates a high severity, while the EPSS score of less than 1% suggests exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Because the defect resides in a library used during decoding, a potential attacker could supply crafted data to trigger the race condition, which would likely require some level of code execution or memory corruption on the target system. The attack vector is inferred to be remote if the decoder processes untrusted data, otherwise it may be local if only trusted data is decoded.