The vulnerability arises from improper type validation in the loadFromSharedState function of the Fraillt bitsery library. When an attacker supplies crafted serialized data that the function accepts as a valid instance of a shared pointer type, the library may read or write memory incorrectly. This flaw can lead to memory corruption and potentially allow arbitrary code execution, compromising the confidentiality, integrity, and availability of the host application.

The affected product is the Fraillt bitsery serialization library, on versions up to and including 5.2.4. The component impacted is include/bitsery/ext/std_smart_ptr.h. The issue is fixed in release 5.2.5, which incorporates the commit 66d16516e24893bebc1c8af52bf2fe9ad0735061. Any installation of 5.2.5 or later is immune.

The CVSS score of 6.3 classifies the flaw as medium severity. No EPSS score is available, so exploitation likelihood cannot be quantified, but the vulnerability has been publicly disclosed and can be exploited remotely. The KEV catalog does not list it. The likely attack vector is by an attacker supplying malicious serialized data over a network to an application that calls loadFromSharedState, often through an untrusted deserialization endpoint. Based on the description, it is inferred that remote exposure of this function creates the opportunity for exploitation.