This vulnerability resides in the rewrite_string function of the tftpd remap code in tftp-hpa up through version 5.4. The function walks heap memory during jump table search, allowing an out‑of‑bounds read. Attacks that cause the kernel to read memory beyond a buffer can crash the forked in.tftpd request handler, potentially resulting in a denial of service. The weakness corresponds to CWE‑125, an out-of-bounds read.

The affected product is tftp‑hpa, a standalone TFTP server implementation. Versions prior to 6.0, including 5.4 and earlier, are vulnerable. All deployments that enable remap jump rules and allow unauthenticated TFTP read or write requests to filenames that match those rules are at risk.

The CVSS score of 6.3 indicates medium severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this remotely by sending specially crafted filename requests without prior authentication. The attack does not grant code execution or data disclosure, but it can destabilize the TFTP service by crashing the request handler, which could lead to service interruption for clients relying on TFTP. Given its medium score and lack of known exploits, monitoring for anomalous TFTP traffic and applying available patches remains prudent.