The vulnerability arises from an incorrect buffer size calculation in tinyexpr’s new_expr function. For arity‑0 expression nodes it allocates less memory than the size of the te_expr structure yet treats the result as a valid object. This mismatch produces undefined behavior and, in builds instrumented with Undefined Behavior Sanitizer, can deterministically terminate the process. The primary impact is a denial of service when an attacker or malicious input triggers the crash.

Applications that embed tinyexpr and link against the commit 4a7456e in the codeplea/tinyexpr repository or its mirror szaydel/tinyexpr are affected. The vulnerability exists at the source level; any build that incorporates that commit is at risk. No official product version numbers are provided, so the check is at the source commit level. The bug was fixed in the subsequent commit fe7459728c2ab8d2f91365abe56601cdd0e24f9b.

The EPSS score is below 1% and the vulnerability is not listed in CISA’s KEV catalog, indicating limited known exploitation. With a CVSS score of 7.5, the vulnerability is considered high severity. Exploitation is likely local: an attacker who can supply expressions—such as an end‑user to a web service, a script, or a command‑line tool that uses tinyexpr—can trigger the failure. While there is no remote code execution, the denial of service effect could be critical in high‑availability or real‑time systems.