A buffer misuse in uuid before 14.0.0 allows unexpected writes to memory when an external output buffer is supplied with UUID versions 3, 5, or 6. This qualifies as an out‑of‑bounds write (CWE‑787) and a write error (CWE‑670) that can corrupt application data or cause abnormal termination. The flaw is limited to the mentioned UUID versions; the widely used UUID version 4 is unaffected.

The vulnerability affects the uuidjs:uuid library in all releases prior to 14.0.0. Any project that imports that library and requests a UUID of version 3, 5, or 6 while providing an external output buffer is potentially vulnerable.

The CVSS base score is 3.2, indicating low severity, and the EPSS score is less than 1 %, highlighting a very low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires that an attacker can supply a known external buffer and choose a vulnerable UUID version – typically through application code that directly calls the library with user‑controlled parameters.