An off‑by‑one stack out‑of‑bounds read occurs in the P61A depacker of libxmp, allowing an attacker to read memory beyond the bounds of a buffer. The vulnerability can leak stack contents into sample metadata or corrupt node data, potentially exposing sensitive process memory or causing loader failure. The impact is purely information disclosure; no direct code execution or privilege escalation is known from the available data.

The bug is present in libxmp versions through 4.7.4, affecting any application that uses libxmp to load P61A modules. Industries that rely on legacy multimedia or game asset processing libraries may be affected if they embed libxmp without later patches.

The CVSS score of 6.9 reflects a moderate severity, highlighting the potential for information disclosure without privilege escalation. The EPSS score of less than 1% suggests that exploitation is unlikely at this time, yet the existence of a stack out‑of‑bounds read means a malicious P61A module crafted by an attacker could read beyond intended buffer boundaries, potentially exposing local process memory to the consuming application. The vulnerability is not listed in the CISA KEV catalog, indicating that no widespread, actively exploited attacks are currently reported, but the attacker can still create a custom module to trigger the read. Since the exploit requires providing a crafted module, the attack vector is a local or remote input that the application accepts and processes through libxmp’s P61A loader, potentially enabling data leakage to the consuming application.