The vulnerability exists in the WaveFunctionCollapse function of the aardappel lobster library, where improper bounds handling can corrupt memory. This flaw allows an attacker with local access to overwrite memory addresses, potentially leading to crashes, data corruption, or in some scenarios, local privilege escalation. The weakness is identified as a buffer over-read and an out‑of‑bounds write (CWE‑119 and CWE‑787).

The issue affects the aardappel lobster product, specifically any version of the library prior to the 2025.4 release. The affected component is the file dev/src/lobster/wfc.h within the lobster source tree.

With a CVSS score of 4.8 the severity is moderate and the EPSS score is below 1%, indicating a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, further suggesting limited threat. The attack vector is inferred to be local only, as the exploit requires execution of the vulnerable function within the local process. An attacker who can run code on the system may trigger memory corruption through crafted input, leading to denial of service or potential escalation if the corrupted memory can be leveraged to execute arbitrary code.