Effekseer fails to validate effect files properly. A crafted file causes the runtime to crash, resulting in a denial of service. The weakness is identified as CWE-237, which describes unvalidated input leading to unstable or insecure behavior.

Applications that use the Effekseer runtime are affected, particularly versions released before 1808. The runtime processes .eff files, and any installation that allows loading of external effect files is vulnerable.

The CVSS score of 5.1 indicates moderate severity. EPSS data is not available, so the statistical likelihood of exploitation is unclear, but the flaw is not listed in the CISA KEV catalog, suggesting no known high‑profile exploitation. Attackers would need to supply a malicious effect file to an instance of Effekseer; if the application exposes a file loading interface to end users or through a network, the threat vector could be local or remote. Given the medium score and absence of public exploits, the risk is moderate but not negligible.