AIKIDO-2025-10330

TL;DR

Affected versions of this package are vulnerable to an integer overflow in the pe.tls.tlsdata.parse_with_opts function due to insufficient bounds checking when parsing Thread Local Storage data. An attacker can exploit this by providing a maliciously crafted PE file with either an excessively large offset or by triggering an integer overflow in the calculation of the Relative Virtual Address, bypassing the offset size checks. It could lead to out-of-bounds memory access, potentially causing a denial-of-service or information disclosure if the application processes unintended memory regions.