The vulnerability is a stack‑based buffer overflow in the JSON parser error reporter of Apache Lucy. It manifests when malformed JSON data is parsed, enabling an attacker to execute arbitrary code with the privileges of the Lucy process. This flaw falls under CWE‑121 and compromises confidentiality, integrity, and availability. Importantly, this issue only affects products that are no longer supported by the maintainer, as the project has been retired and no additional fixes have been released for the ASF‑maintained versions.

All versions of Apache Lucy released by the Apache Software Foundation are affected. The project has been retired and is no longer maintained; therefore no patches or updates have been issued.

The exploitability of this flaw is high because it does not require special user privileges or complex configuration; an attacker can provide malformed JSON data to trigger the overflow. The EPSS score is less than 1%, indicating a low but non‑zero likelihood of exploitation. The CVSS score of 9.8 indicates critical severity. The vulnerability is not listed in the CISA KEV catalog, and the lack of a patch combined with the nature of the stack buffer overflow implies a significant risk. The most likely attack vector is network or local access to the Lucy instance.