The vulnerability is an out‑of‑bounds write located in the Trim/Unmap operation of Seagate’s openSeaChest utility. When this operation is invoked, the program writes 16 bytes outside of the allocated memory buffer describing a range of logical block addresses to deallocate. This buffer overflow can corrupt adjacent memory, potentially leading to a crash or, if an attacker can control the data, to arbitrary code execution. The primary impact is memory corruption that could destabilize the system or allow further exploitation if conditions permit.

The affected product is Seagate’s openSeaChest, version 26.03.0, released for all supported operating systems. Only this version is listed as vulnerable; newer releases are presumed to contain the fix.

The CVSS score of 4.6 indicates a moderate severity. No EPSS score is provided, and the vulnerability is not reported in the CISA KEV catalog. Because the flaw requires the Trim/Unmap command to be executed, the attack surface is limited to local or privileged users able to run openSeaChest. The risk is therefore moderate, with low likelihood of public exploitation but sufficient concern for users who routinely invoke the Trim operation.