The vulnerability arises from improper input validation in the JIT compilation engine exposed through the CFFI layer. An attacker employing the library’s foreign function interface can provide crafted instruction sequences that trigger the JIT to generate and execute arbitrary code. This yields complete control over the host process, allowing escalation of privileges or full compromise of the system.

The affected product is the rssn scientific computing library from Apich‑Organization. No specific product version is listed in the CNA data, but public references indicate a release tag v0.2.9 that may contain the fix. Systems that load rssn via CFFI—especially those running with elevated privileges or in high‑performance computing environments—are potentially impacted.

The CVSS base score of 9.4 classifies the issue as critical. The EPSS score is less than 1%, indicating a low current exploitation probability, and the vulnerability is not listed in the KEV catalog. Nevertheless, the attack requires only local or foreign code that can call the library, so any environment running rssn and exposing its CFFI interface is at risk if inputs are not tightly controlled.