The vulnerability allows for cleartext storage of sensitive data in memory within the Mesalvo Meona Client Launcher and Server components. This flaw means that if an attacker can access the process memory—through local privilege escalation, debugging tools, or other memory‑reading techniques—they could retrieve secrets such as usernames, passwords, or cryptographic keys. This breach would compromise confidentiality and could lead to further exploitation of the system.

The issue affects Mesalvo Meona Client Launcher Component versions up to 19.06.2020 15:11:49 and Mesalvo Meona Server Component versions through 2025.04 5+323020. Both components are part of Mesalvo’s Meona platform and are used for launching clients and managing server operations.

With a CVSS score of 6.0, the vulnerability is considered moderate severity. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local or involve memory‑reading privileges, meaning an attacker with sufficient access to the affected process could exploit the flaw. Until a patch is applied, the risk remains moderate, and organizations should treat this as a potential data exfiltration threat.