A signed integer overflow in s2.NewDict() allows an attacker to provide a dictionary containing a uvarint-encoded repeat value larger than the maximum 64‑bit signed integer. The overflow turns the repeat value into a negative number, which is then used in unsafe.Pointer arithmetic during Dict.Encode(). This results in an out-of-bounds write that typically terminates the process with a segmentation fault. The impact is a denial of service and potential instability in any application using compress.

The vulnerability affects the klauspost/compress library across all releases before version 1.18.7. The issue was resolved in v1.18.7, which should be deployed to stop the overflow and subsequent crash.

The CVSS score of 7.5 indicates high severity. The exploit requires the ability to supply a crafted dictionary to the application’s compression code, making it an in‑process vulnerability rather than a remote network attack vector. The EPSS score is < 1%, indicating a low probability of exploitation, but the lack of listing in the CISA KEV catalog suggests no confirmed widespread exploitation to date. Nonetheless, the severe consequence of a SIGSEGV and the high CVSS recommend immediate mitigation.