The vulnerability resides in the LatencyStats.recordDetectedPause method of the LatencyUtils library, where an attacker can manipulate input to trigger memory corruption. This flaw is categorized as a classic buffer overrun (CWE-119), which can corrupt internal data structures and potentially allow the attacker to alter program behavior or cause a crash. The impact is strictly local; a malicious user with access to the environment in which LatencyUtils runs could exploit this to destabilize the application or gain elevated privileges on that host.

The issue affects LatencyUtils versions up to and including 2.0.3. The affected component is PauseDetector within the LatencyUtils project. Any deployment that incorporates these library versions is potentially vulnerable until it is updated to a patched revision or a mitigated build.

The CVSS score of 4.8 indicates a medium risk level, but the lack of network exposure limits the vector to local execution. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that it is not a widespread exploit currently. However, the publicly disclosed nature of the exploit means that anyone with local access could attempt to trigger the crash or arbitrary code execution if the memory corruption is leveraged effectively. No known workaround or patch is currently provided by the vendor, so the risk persists until an updated version is released.