The vulnerability is a stack‑based buffer overflow in the JSON parser error reporter of Apache Lucy. The overflow occurs when processing malformed input, which could allow an attacker to execute arbitrary code with the privileges of the Lucy process. This type of flaw falls under CWE‑121 and directly compromises the confidentiality, integrity, and availability of the system it runs on.

All versions of Apache Lucy released by the Apache Software Foundation are affected. The project has been retired and is no longer maintained; therefore no patches or updates have been issued.

The exploitability of this flaw is high because it does not require special user privileges or complex configuration; an attacker can provide malformed JSON data to trigger the overflow. The EPSS score is less than 1%, indicating a low but non‑zero likelihood of exploitation. The CVSS score of 9.8 indicates critical severity. The vulnerability is not listed in the CISA KEV catalog, and the lack of a patch combined with the nature of the stack buffer overflow implies a significant risk. The most likely attack vector is network or local access to the Lucy instance.