The vulnerability in the cryptography library allows a buffer overflow when a non‑contiguous Python buffer is provided to APIs that accept buffer objects, such as Hash.update(). This overflow can corrupt memory and potentially lead to arbitrary code execution or a crash. The weakness is characterized by CWE‑119 and CWE‑131, indicating improper handling of buffer sizes and memory boundaries.

The affected product is the pyca:cryptography library. Versions from 45.0.0 up to, but not including, 46.0.7 are vulnerable. The issue has been addressed in release 46.0.7.

The CVSS score of 6.9 indicates a moderate impact if exploited. EPSS indicates the likelihood of exploitation is very low, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely local or application‑level: any Python program that uses cryptography and passes a non‑contiguous buffer to a relevant API could trigger the overflow. Due to the nature of the overflow, successful exploitation could compromise application or system integrity.