The vulnerability exists in the `readFromDataView` decoder function in dmonad's lib0 library before version 0.2.119. The decoder can be manipulated to read beyond the allocated buffer, resulting in an out-of-bounds read (CWE-125). This allows an attacker to access adjacent memory regions that may contain sensitive information like credentials or logs. The CVSS v3.1 score is 8.6 (high), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and a confidentiality impact rated as high. There is no known exploit in the wild and no vendor advisory or patch information is provided.

The vulnerability allows an attacker to read memory beyond the intended buffer boundary, potentially exposing sensitive information such as credentials or logs. There is no impact on integrity or availability. The confidentiality breach could lead to information disclosure risks depending on what adjacent memory contains.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Avoid using affected versions (<=0.2.118) if possible until a fix is available.