DivvyDrive receives input that determines which object attributes are allocated. The lack of proper validation allows an attacker to manipulate these attributes, causing the system to allocate excessive resources. This uncontrolled allocation can overwhelm memory or CPU, leading to a denial of service that affects availability and potentially the stability of the host machine.

Instances of DivvyDrive Information Technologies Inc. DivvyDrive versions 4.8.2.19 through 4.8.3.1 are compromised. The vulnerability was fixed in 4.8.3.2, so any deployment of those earlier releases must be considered at risk.

The CVSS score of 8.3 indicates high severity. Although the EPSS score is not provided, the absence of a KEV listing does not diminish the potential for exploitation. It is likely that the attack vector is remote, given that the manipulation occurs through data supplied by an external user. An attacker that can influence object attribute selection can trigger large resource requests, exhausting system capacity.