A heap-based buffer over-read in praydog's UEVR system occurs in the file lparser.C when compiling untrusted Lua code. The vulnerability allows an attacker to read memory beyond the intended buffer, potentially exposing sensitive information stored in adjacent memory areas. This flaw is classified as CWE-125 and results in a moderate CVSS score of 6.9, indicating that while it does not provide direct code execution, it can leak confidential data that may aid further attacks.

The flaw is present in all versions of praydog UEVR prior to 1.05. Upgrading to version 1.05 or later removes the affected code path and mitigates the read underflow.

The EPSS score for this vulnerability is less than 1%, indicating a very low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector requires execution of untrusted Lua code within the UEVR environment; an attacker would need to provide specially crafted input that triggers the lparser.C over-read. The moderate CVSS score reflects the confidentiality impact rather than an integrity or availability breach.