The vulnerability is a stack‑based buffer overflow in the JSON parser error reporter of Apache Lucy. The overflow occurs when processing malformed input, which could allow an attacker to execute arbitrary code with the privileges of the Lucy process. This type of flaw falls under CWE‑121 and directly compromises the confidentiality, integrity, and availability of the system it runs on.

All versions of Apache Lucy released by the Apache Software Foundation are affected. The project has been retired and is no longer maintained; therefore no patches or updates have been issued.

The exploitability of this flaw is high because it does not require special user privileges or complex configuration; an attacker can provide malformed JSON data to trigger the overflow. No EPSS score is available, but the lack of a patch and the nature of the stack buffer overflow imply a significant risk. The vulnerability is not listed in the CISA KEV catalog, and no CVSS score is provided, so the exact severity rating cannot be quoted. The most likely attack vector is network or local access to the Lucy instance.