A heap-based buffer overflow is present in the add_to_challenge() function of the Cyrus SASL DIGEST-MD5 plugin. The function calculates the buffer size for a challenge/response string before escaping special characters but fails to adjust the size afterward. When an attacker supplies a specially crafted challenge value, such as a long realm or nonce, the function writes past the allocated buffer into a concatenation operation, potentially causing a crash or memory corruption. The flaw may lead to denial of service or a crash.

Version information is not specified in the CVE data, but the vulnerability affects Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, Red Hat OpenShift Container Platform 4, and Red Hat Hummingbird 1. All these distributions deploy the Cyrus‑SASL implementation that contains the vulnerable DIGEST-MD5 plugin. Clients and servers running these products that enable DIGEST‑MD5 (or HTTP Digest) authentication are susceptible.

The CVSS score of 7.5 indicates a high severity. The EPSS score is not available, so historical exploitation data cannot be evaluated, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is network‑based: an attacker who can position a malicious or on‑path DIGEST‑MD5 or HTTP Digest server can send a crafted challenge during the SASL authentication phase, which triggers the overflow in the connecting client. Because the memory corruption occurs in user space on the client side, the impact may range from a crash to potential exploitation if the overflow can be manipulated.