The flaw is a buffer overflow in Zlib::GzipReader’s zstream_buffer_ungets function within the Ruby zlib library. The function prepends caller‑supplied bytes ahead of existing output but does not verify the backing Ruby string has adequate capacity before the memmove operation. When the combined input exceeds the capacity, memory corruption occurs. This type of vulnerability aligns with CWE‑120 and CWE‑131 and can result in arbitrary code execution or process crash if an attacker supplies a sufficiently large payload.

Affected are Ruby zlib versions 3.0.0 and earlier, 3.1.0, 3.1.1, 3.2.0, and 3.2.1. The issue was fixed in version 3.0.1, 3.1.2, and 3.2.3. All Ruby applications that depend on zlib and invoke Zlib::GzipReader::ungetc with large streams are vulnerable.

The CVSS score is 1.7, indicating low severity. Exploit probability is not available, and it is not recognized in the CISA known exploitation catalog. Based on the description, it is inferred that the likely attack vector involves supplying a large gzip payload to the Zlib::GzipReader::ungetc function, which could trigger the overflow. The risk is limited to applications that accept large gzip payloads but should still be mitigated promptly.