The vulnerability in cadaver’s turso3d allows an attacker to write beyond the bounds of an array and perform arithmetic with a zero divisor, leading to a null pointer dereference and the reuse of uninitialized resources. These weaknesses combine to enable arbitrary code execution. The high CVSS score of 10 confirms that an exploitation would compromise confidentiality, integrity, and availability of the affected system. “Out‑of‑bounds write” is a classic memory corruption flaw that typically permits control over program flow.

The affected product is cadaver’s turso3d. No specific version numbers are given in the CVE information, so the patch status of installed instances cannot be determined from this data alone.

With a CVSS of 10 the vulnerability is considered extremely severe. The EPSS score of less than 1% suggests that, although exploitation is possible, it is currently statistically unlikely. The vulnerability is not listed in the CISA KEV catalog. Because the description does not specify an attack vector, it is inferred that the exploitation might require local access or could be achieved remotely if the vulnerable code is exposed through a service. Without explicit vector information, administrators should assume the worst‑case scenario and treat the flaw as a potential remote code execution risk.