The vulnerability is in the argon2i_32 routine of the Monocypher C library, accessed via the Cython wrapper in the PyMonocypher package. Because the function does not validate the nb_blocks size supplied by the caller, a buffer that is too small can cause a heap write beyond its allocation, potentially corrupting heap memory. The CVE description does not indicate that this overflow leads to a crash or code execution, only that heap corruption could occur.

Any installation of Jetperch's pymonocypher before version 4.0.2.8 is affected. The package is used by developers who integrate Monocypher cryptographic primitives, typically in Python environments that rely on the Cython wrapper.

The CVSS score of 5.1 places this issue in the medium severity range. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require that the attacker can control the input to argon2i_32, implying a local or insider context, since the overflow occurs only when a caller supplies a buffer that does not respect the API contract.