The xray‑monolith component suffers a type‑confusion flaw where a value of one type is accessed using an incompatible type. Such misuse of type handling can corrupt memory, causing unexpected reads or writes that may undermine confidentiality, integrity, and availability if an attacker can trigger the behavior. The high severity score of 9.1 reflects the potential for deep compromise.

The vulnerability applies to the xray‑monolith released by themrdemonized. Any deployment of the component prior to the 2025.12.30 release is considered affected; the CVE description does not enumerate additional minor revisions.

The CVSS score of 9.1 marks the flaw as critical. Its EPSS score is < 1%, indicating a low current exploitation probability, and it is not listed in the CISA KEV catalog. Based on the nature of a type‑confusion bug and the fact that the service is a network‑facing process, it is inferred that a remote attacker could potentially exploit the flaw via a client request, but no documented exploitation vector is provided at this time.