The vulnerability in Crypt::Argon2 versions 0.017 up to but not including 0.031 arises from improper handling of empty encoded input in the argon2_verify function. Specifically, the function uses encoded_len - 1 as the length argument to memchr without checking if encoded_len is zero. When the encoded string is empty, this subtraction underflows to SIZE_MAX, causing memchr to scan out-of-bounds heap memory searching for a '$' separator byte. This can cause a heap out-of-bounds read, potentially crashing the process or leaking memory content related to the position of the '$' byte in adjacent memory. The issue is classified under CWE-126 (Buffer Over-read) and CWE-191 (Integer Underflow).

The vulnerability can cause a denial of service through process crashes due to out-of-bounds memory reads. Additionally, it may leak information about adjacent heap memory contents, specifically the position of a '$' byte, which could be used in further parsing or analysis. There is no indication of confidentiality, integrity, or availability impacts beyond these effects. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid invoking argon2_verify with potentially empty encoded input strings. Validate inputs before calling argon2_verify to ensure encoded strings are non-empty to prevent triggering the out-of-bounds read.