The CVE describes an out-of-bounds read in the Rust demangler implementation within rz-libdemangle. When the demangler data structure has not been initialized, the demangle routine reads beyond the allocated buffer, exposing sensitive memory contents to the caller. This weakness is classified as CWE‑125 and can lead to unintended data disclosure.

Any installation of the rizinorg:rz-libdemangle library built before the commit 6bf56d3 (6bf56d32b32547ae4cb069ccfc2d2b6c7b63a4cb) is vulnerable. Versions included in that commit or later contain the fix and are not affected.

With a CVSS score of 5.5 the vulnerability is of medium severity, while the EPSS score of < 1% and the absence from the CISA KEV catalog suggest a low likelihood of widespread exploitation. The most probable attack vector is a local or within‑process invocation of the demangler on uninitialized data, possibly during automated symbol processing or by a malicious binary that links against rz-libdemangle.