The vulnerability resides in the legacy libtomcrypt library bundled within Net::Dropbear Perl modules before 0.14. When used, a memory corruption flaw (CWE-1395) in that library can occur upon processing certain cryptographic inputs, potentially allowing an attacker to overwrite memory and execute arbitrary code within the context of the module.

All Net::Dropbear Perl packages released by ATRODO with versions earlier than 0.14 are affected. These modules embed Dropbear 2019.78 or older releases that contain libtomcrypt v1.18.1 or earlier. Consequently, any system running these specific Perl modules that interacts with Dropbear is at risk.

The CVSS score of 10 denotes a critical risk level, while the EPSS score of less than 1 % indicates a very low but non‑zero likelihood of exploitation. KEV lists the vulnerability as not known to be exploited in the wild. Based on the type of library and that Net::Dropbear typically serves as an SSH‑style server, the likely attack vector is an attacker sending crafted cryptographic data over a network connection; the severity remains high if exploitation succeeds. This attack vector is inferred, not explicitly stated in the provided description.