Sereal::Encoder Buffer Overwrite Vulnerability Due to Embedded Zstandard Library Race Condition

A buffer overwrite vulnerability has been identified in Sereal::Encoder versions 4.000 through 4.009_002 for Perl. This issue arises from a race condition in the one-pass compression functions of the embedded Zstandard library, prior to version 1.3.8. The vulnerability allows an attacker to write bytes out of bounds by using an output buffer smaller than the recommended size.

Impact

Exploitation of this vulnerability could lead to a buffer overwrite, allowing for potential arbitrary code execution or causing a denial-of-service condition.