The VisualData Extension for MediaWiki contains an inefficient regular expression that can trigger exponential blowup when processing crafted input. This flaw, identified as CWE‑1333, allows an attacker to supply a specially structured string that causes the server to consume excessive CPU resources, leading to a denial‑of‑service condition for the entire MediaWiki application.

The vulnerability affects Wikimedia Foundation’s MediaWiki VisualData Extension, version 1.45.0. Any installation running this extension—and potentially any higher versions that have not applied the fix—could be compromised. The affected CPE identifiers include mediawiki:mediawiki:1.45.0 and wikisphere:visualdata:mediawiki.

The CVSS v3.1 base score is 5.3, indicating a moderate severity. The EPSS rating is less than 1 %, suggesting that exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Since the flaw is triggered by crafted user input, the likely attack vector is remote via HTTP requests that include malicious content parsed by the extension. An attacker could target a publicly exposed MediaWiki instance, causing a denial‑of‑service that impacts availability for all users.