PhysicsFS versions up to 3.2.0 contain an out‑of‑bounds read bug in the __PHYSFS_utf8codepoint helper. The defect allows an attacker to supply archive entries whose names end with a six‑octet UTF‑8 sequence, causing an off‑by‑one cursor advance and an over‑read that can crash the code that compares or hashes the file name. The result is a denial‑of‑service through an application crash; while the read occurs outside the intended buffer, the vulnerability does not convey code execution or direct memory disclosure within the information supplied.

The issue affects any install of icculus:PhysicsFS version 3.2.0 or earlier. No specific patch versions are listed; users should assume all releases prior to any future update that resolves the bug are vulnerable.

The CVSS score of 4.8 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that it is not known to be actively exploited. The most likely attack vector involves a local attacker supplying a crafted archive to a program that uses PhysicsFS, or a remote attacker who can influence the archive contents that the application later processes. The exploit is straightforward once the vulnerable functions are triggered, and the impact is a crash and loss of service. The risk is moderate, but patching remains the recommended response.