The vulnerability is a buffer overflow in the ThreadReadButtons routine of striso-control-firmware, specifically in the firmware build identified by commit 54c9722. Supplying an overlong input can overwrite adjacent memory, which may result in uncontrolled memory corruption, program crashes, or unintended behaviour. The description does not state that this flaw directly grants code execution, but buffer overflows can potentially enable remote or local exploitation if the overflow is carefully crafted to redirect execution flow, a scenario that would depend on the specific execution environment and the nature of the overwritten data.

Affected by the firmware build 54c9722 of striso-control-firmware; no vendor or operating system information is available beyond the repository identifier. The flaw exists solely in the mentioned commit hash.

The CVSS score of 7.5 indicates a serious risk if the vulnerability is exploited successfully, while the EPSS score of < 1% shows a low probability of exploitation at present. The flaw is not listed in CISA KEV. Exploitation would likely require delivering crafted input to the ThreadReadButtons routine, which may be possible over any interface that accepts button sequences, such as a network, serial, or other control channel. If the overflow is triggered, it could lead to memory corruption and potentially compromise the affected device’s reliability and integrity.