CVE-2024-27280 is a critical buffer overread vulnerability in the StringIO Ruby gem versions prior to 3.0.1.1. The flaw allows the ungetbyte and ungetc methods to read past the end of a string, potentially causing subsequent calls to StringIO.gets to return unintended memory contents. This issue affects Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The vulnerability is fixed in StringIO 3.0.1.1 and later, and Ruby 3.2.x and later are not affected.