The vulnerability is an out‑of‑bounds array access that may cause the client to terminate. The crash results in denial of service, disrupting the end‑user's ability to communicate. This weakness is classified as CWE‑125 and does not provide code execution or privileged escalation. The impact is confined to the local machine where the Mumble client runs.

The affected product is the Mumble audio‑chat client from the Mumble project. All releases before 1.6.870 contain the bug. Users on Windows, macOS, Linux, or other supported platforms running any pre‑1.6.870 build are at risk. The vulnerability is vendor and product specific and is mitigated by acquiring a later version.

The CVSS score of 3.7 indicates moderate severity, and the EPSS of less than 1 % shows a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation. Attacking this flaw would require that a malicious packet be processed by the client, likely from a remote server or a local user providing malformed data; these inferences are based on the nature of an out‑of‑bounds access and are not directly stated in the CVE description.