A heap‑based buffer over‑read or overflow exists in the dlib library, caused by a buffer copy that does not verify the size of the input. This flaw is associated with the inflate.C module and may allow an attacker to corrupt memory, potentially leading to arbitrary code execution or denial of service. The weakness matches CWE‑120 and CWE‑787, both indicating classic buffer overflow vulnerabilities.

The issue affects the dlib library from the vendor davisking and impacts any installations of dlib prior to version 19.24.9.

The CVSS score of 5.2 indicates moderate severity, while the EPSS score of less than 1% points to a very low but nonzero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, reducing immediate exposure. Based on the description, it is inferred that exploitation would require delivery of a crafted payload to the inflate.C routine, which processes external input streams. Based on the description, it is inferred that if the attacker gains sufficient privileges to run code within the dlib context, the memory corruption could be leveraged for privilege escalation or arbitrary code execution.