AIKIDO-2026-10471

TL;DR

Affected versions of this package are vulnerable to multiple memory-related issues due to improper handling of externally provided buffers during bitarray conversions. The affected logic performs operations on user-influenced byte-like input without consistently validating buffer sizes or ensuring the underlying memory remains valid, which can result in out-of-bounds access and use-after-free conditions. An attacker able to supply crafted input may trigger reads or writes on invalid memory, potentially leading to crashes or undefined behavior.