Graphite before version 1.3.15 contains an integer underflow in the slotat function, which may let an attacker supply a negative offset that bypasses the slot‑map boundary check. The resulting out‑of‑bounds write can overwrite adjacent memory supporting any subsequent exploit that uses the corrupted data, potentially leading to memory corruption, denial of service, or arbitrary code execution. The vulnerability is classified under CWE‑191. The description focuses on the unbounded write, but it does not detail whether the write is exploitable beyond corruption, so analysts should treat it as a high‑severity integrity risk.

The Graphite project’s Graphite software is affected. All releases prior to 1.3.15 are vulnerable, including the 1.3.14 release identified in the source commit history. Systems running these versions should consider themselves at risk.

The CVSS score of 7.3 indicates a high severity with potential for significant impact. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalogue. The likely attack vector is remote, as the flaw occurs in Graphite actions that can be invoked over the network. However, the brief description does not explicitly state the attack surface, so the exact requirements for exploitation remain ambiguous. Given the high severity and lack of mitigation, the risk is significant for exposed instances of Graphite before 1.3.15.