uuidjs's uuid library was vulnerable prior to version 14.0.0 because the v3, v5, and v6 functions accepted caller-supplied output buffers without validating bounds. When a small buffer or an excessively large offset is used, the library performs silent partial writes into that buffer. This unchecked memory write can corrupt arbitrary data and, if the buffer contains executable or control data, can be leveraged to achieve arbitrary code execution. The weakness corresponds to CWE-787 (Unchecked Buffer Copy) and CWE-823 (Improper Output Check).

The vulnerable product is uuidjs:uuid, an open-source Node.js library used for UUID generation. All releases before 14.0.0 are affected whenever the v3, v5, or v6 functions are invoked with a caller-provided buffer. Only this specific buffer-accepting code path is impacted; other parts of the library remain unchanged.

The public CVSS score is 8.1, reflecting high severity. An EPSS score of less than 1% indicates a very low, yet non-zero, probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Exploitability requires an adversary to feed a malicious buffer or manipulate the buffer offset in the UUID generation routine. While the attack vector is typically local to the application, it could be remote if the application exposes input that influences the buffer size or contents. The silent memory corruption could lead to data integrity breach, potential code execution, or denial of service.