A flaw exists in the SseParser.kt file of the ag‑ui‑protocol AG‑UI Kotlin Community SDK. The issue is caused by improper handling of exceptional conditions when the parser processes input. An attacker can remotely manipulate requests to trigger those exceptional conditions, which may alter the application’s execution flow or corrupt its internal state. The CVE description does not detail the exact downstream impact, so the precise consequences are undefined, but the vulnerability clearly threatens the integrity of the application’s runtime behavior.

The vulnerable component is the ag‑ui‑protocol AG‑UI Kotlin Community SDK. All releases up to and including 2026‑09‑23 contain the affected code. No specific version numbers are listed, and the vendor’s CPE indicates a generic placeholder for all current releases. Therefore any deployment of this SDK prior to an official patch is a potential risk.

The CVSS score of 5.3 places this vulnerability in the moderate severity range. The EPSS score is not available, implying no public exploitation data has been reported. The CVE is not listed in CISA’s KEV catalog. The attack vector is remote, meaning the attacker need not have local or privileged access. Based on the description, it is inferred that an attacker can manipulate the parser to change application behavior or potentially execute unintended code. Until the vendor releases an updated version, the exploitation window remains open.