An integer overflow flaw exists in the Avro decoder where 64‑bit values from an external source are truncated or summed using signed‑int arithmetic before bounds checking. On 32‑bit platforms the truncation can bypass slice limits, choose an incorrect union branch, or cause a negative allocation that triggers a panic. Even on 64‑bit targets, cumulative‑size arithmetic overflows break array and map size limits, and improper block‑header handling can negate negative sizes, leading to unbounded memory allocations or crashes. The downstream effect is a denial of service by provoking a panic or by silently corrupting memory boundaries.

The vulnerable product is the iskorotkov/avro Go Avro codec. Versions prior to 2.33.0 are affected. All architectures that compile the Go runtime, including 32‑bit (386, arm, mips, wasm) and 64‑bit (amd64, arm64), are susceptible.

The CVSS base score is 8.7, indicating a high‑severity vulnerability. EPSS data is not available, and the issue is not listed in CISA’s KEV catalog. An attacker can trigger the flaw by crafting malicious Avro data sent over the network or supplied from an external source, exploiting the decoder without requiring any privileged access. The combination of remote attack surface and crash outcome results in a high exploitation risk for impacted services.