Sereal::Encoder, a Perl module, incorporates a version of the Zstandard library that has a race condition in its one-pass compression routine. Versions 4.000 through 4.009_002 are affected, and the flaw allows an attacker to write bytes out of bounds when the output buffer is smaller than recommended, leading to memory corruption and potentially arbitrary code execution (CWE-1395).

The vulnerability impacts the Sereal::Encoder module released by YVES for Perl, affecting all releases from 4.000 up to and including 4.009_002.

The flaw carries a CVSS score of 8.1, marking it as high severity, yet its EPSS score is below 1%, indicating a low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply crafted data to the vulnerable compression function, so the attack vector is inferred to be local or remote depending on how the module is used in an application. Upgrading to version 4.010 or later removes the embedded vulnerable Zstandard code and eliminates the risk.