The vulnerability arises from improper pointer arithmetic in the zlib decompression routines within the root‑project, specifically in builtins/zlib/inftrees.c. This causes an out-of-bounds read (CWE‑125) that can corrupt memory and may expose sensitive data or lead to memory corruption. The exact consequences depend on the environment and input handling; execution of arbitrary code is a possibility but is not confirmed by the information provided.

The issue affects the root‑project root software, impacting all releases through version 6.36.00‑rc1. Users running any of these released versions should verify their installed version and plan to upgrade to a patched release.

The CVSS score of 9.3 denotes critical severity, implying that exploitation could compromise confidentiality, integrity or availability. The EPSS score is reported as less than 1%, suggesting that exploitation at present is rare, but the vulnerability is not listed in the CISA KEV catalog, meaning there is no known active exploitation. Based on the nature of the flaw, the attack vector is likely remote, triggered by malicious compressed input sent over a network or from compromised files; this inference is drawn from the involvement of zlib decompression routines.