The vulnerability originates in the RTLIL::Const::set function within the BLIF File Parser component, where improperly bounded writes to a heap-allocated buffer can cause a heap-based overflow. This overflow occurs when an attacker supplies a malicious BLIF file that the parser processes. According to the official description, it is possible for local users to trigger the overflow, which may lead to a crash or corruption of program memory. The CVE details do not explicitly claim arbitrary code execution, so any such claim is beyond the stated evidence.

YosysHQ yosys users running version 0.62 or earlier are affected. The issue is confined to the kernel/rtlil.h component responsible for parsing BLIF files. No newer releases or alternative branches have been reported to contain the flaw. Systems that load untrusted BLIF files locally are susceptible.

The CVSS score of 4.8 indicates moderate severity, while the EPSS score below 1% suggests a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Because the attack vector is local, only users with local filesystem access or attackers who gain local foothold can exploit it. Nonetheless, since heap overflows can degrade reliability or provide a foothold for more advanced attacks, administrators should treat the patch as a priority.