The vulnerability is an integer overflow in the Ash.Vector module where vector length is packed into a 16‑bit field without bounds checking. An attacker can create a vector of more than 65,535 elements; the 16‑bit header wraps modulo 65,536, so the stored dimension no longer matches the number of floats. Later when Ash calls from_binary/1 it reads the wrapped dimension and attempts to parse that many elements, causing mis‑alignment and raising an error. This corrupts stored data and crashes any read operation, effectively denying access to the affected record.

Ash project Ash, versions 2.14.13 through 3.32.1 (the issue is fixed in 3.32.2 and later).

The CVSS score of 5.9 signifies moderate severity. The EPSS score is not available, so exploitation likelihood cannot be quantified from public data. It is not listed in the CISA KEV catalog. The flaw can be exploited by any actor who can submit a vector with more than 65,535 elements; whether the attack is local or remote depends on how the application accepts vector input. Upon exploitation, any future read of the corrupted record will raise an exception, causing denial of service and potentially data loss.