The vulnerability resides in the parseExpression and parseExprList functions of the V Language parser within universal‑ctags. A crafted input can cause the parser to recur without bounds, ultimately exhausting the call stack or available memory, and thus incapacitating the process. This uncontrolled recursion is classified under CWE‑835 and involves improper resource handling (CWE‑674).

The affected product is universal‑ctags, specifically the ctags component. Versions up to and including 6.2.1 are vulnerable. Any installation that utilizes the V Language parser implementation in parsers/v.c may be impacted.

The CVSS score of 4.8 indicates a moderate severity. The EPSS score is below 1%, which suggests a low probability of exploitation on the public internet. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation at this time. Based on the description, it is inferred that the attack requires local or privileged execution on the host running ctags, as the manipulated input must be parsed by the V Language parser. The attacker could use the public exploit code to trigger the recursive parse, causing the process to crash or hang, resulting in a denial of service.