The vulnerability is a race condition in the one‑pass compression functions of the Zstandard library embedded within Sereal::Encoder versions 4.000 through 4.009_002. The defect permits an attacker to trigger an out‑of‑bounds write when the compression routine writes to an output buffer that is smaller than the recommended size. This corruption can overwrite adjacent memory, potentially enabling arbitrary code execution. The weakness corresponds to an out‑of‑bounds write (CWE‑787) coupled with a race condition (CWE‑1395).

The affected product is Sereal::Encoder for Perl, provided by the YVES vendor. All releases from version 4.000 up to and including 4.009_002 contain the vulnerable Zstandard implementation. Versions 4.010 and later incorporate the fixed library and are not affected.

The CVSS base score of 8.1 marks this flaw as high severity. The EPSS score indicates that the probability of exploitation in the wild is below 1 %, and it is not currently listed in CISA’s KEV catalog. Because the weakness lies in compression logic, an attacker must be able to invoke the Zstandard compression functions, which typically requires sending crafted data to an application that uses Sereal::Encoder. This suggests a local or application‑level attack vector, and no evidence of a publicly available exploit is known.