The Text::Minify::XS Perl module has a heap overflow when processing certain malformed UTF‑8 characters in its minify and minify_utf8 functions, as stated in the updated advisory. This overflow can corrupt heap memory and potentially cause a crash. While the description does not directly mention exploitation beyond memory corruption, the nature of a heap overflow *may* allow an attacker to achieve arbitrary code execution if they can influence the vulnerable code path. This possibility is inferred from the target type, not explicitly confirmed in the advisory.

The vulnerability affects the RRWO Text::Minify::XS module for Perl, specifically all releases before v0.7.8 (including v0.3.0 through v0.7.7). Any application that imports this module and processes user‑supplied text is at risk of heap corruption if it uses one of the affected versions.

The CVSS score of 7.5 indicates high severity. An EPSS score of <1% indicates a very low estimated likelihood of exploitation. The vulnerability is not included in CISA's KEV catalog. Exploitation would require an attacker to supply a crafted malformed UTF‑8 string to the vulnerable functions. Successful exploitation could result in a denial of service and, depending on the application's privileges, might allow arbitrary code execution—an outcome inferred from the heap overflow behavior rather than explicitly documented.