Based on the description, the vulnerability involves an out-of-bounds read triggered by the ldebug.C module in WickedEngine. Based on the description, it is inferred that the vulnerability does not allow code execution or denial of service; the impact is limited to the potential exposure of private data from memory. The weakness is classified as CWE-125, an out-of-bounds read, which may lead to leakage of sensitive information in systems that process untrusted input. The CVSS score of 5.1 indicates a moderate security impact with potential confidentiality concerns for applications running the vulnerable engine.

WickedEngine from vendor turanszkij is affected when the installed version is earlier than 0.71.705. The issue surfaces in the engine’s LUA modules, specifically when loading or executing the ldebug.C file. Versions v0.71.704 and below are vulnerable; upgrading to v0.71.705 or later removes the flaw.

Based on the description, the likely attack vector is local or application-level access to the engine. The CVSS base score of 5.1 reflects moderate severity, while the EPSS score of less than 1% shows a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no confirmed active exploitation. An attacker would need local or application-level access to the engine to trigger the read; remote exploitation is unlikely without additional vulnerabilities. The risk is primarily data exposure rather than privilege escalation or disruption.