This vulnerability involves improper input validation in the libcodec2_sec_flacdec.so component before SMR Aug-2026 Release 1. Local attackers can exploit this flaw to write outside the bounds of allocated memory, potentially causing memory corruption. The CVSS 4.0 vector indicates local attack vector with low complexity and no privileges required, but the overall impact and exploitability metrics are marked as unknown or not specified. No vendor advisory or patch information is provided, and no known active exploitation has been reported.

Successful exploitation allows a local attacker to write out-of-bounds memory, which can lead to memory corruption. The exact consequences of this corruption (such as privilege escalation or denial of service) are not detailed in the provided information. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit local access to trusted users to reduce risk.