The vulnerability stems from improper bounds checking in the memory handling routines of doslib. This flaw allows an attacker to write or read beyond the intended buffer, potentially corrupting memory or executing arbitrary code. The impact includes compromise of confidentiality, integrity, or availability of the system using the library.

Vendors and products affected are joncampbell123: doslib, specifically all releases prior to the 20250729 version. No further patch or version details are provided beyond the cutoff date.

The CVSS score of 7.8 indicates a high severity level. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. While the exact attack vector is not explicitly stated, it is inferred that the flaw could be triggered by malformed input processed by the library, suggesting a potential local or remote exploitation scenario. The lack of immediate public exploit evidence makes the risk moderate-high until a confirmed exploit or patch is released.