The vulnerability is an out-of-bounds write triggered by the openSeaChest tool's --showSupportedFormats command when interacting with an NVMe device that contains a malformed FLBAS byte. The write pushes an additional byte beyond the allocated buffer, potentially corrupting adjacent memory. While the CVSS score is low, the flaw could lead to a crash or unintended behavior, and if the tool runs with elevated privileges could theoretically be leveraged for local privilege escalation or denial of service.

All users of Seagate's openSeaChest v25.05.3 across supported operating systems – the tool runs on Windows, Linux, and macOS – are affected. The issue manifests whenever the tool enumerates supported formats on any NVMe device, especially if a device presents a bogus FLBAS byte.

The CVSS score of 1.8 indicates a low severity, and the EPSS score is not available yet. The vulnerability is not listed in CISA KEV. The attack requires physical access to supply a malicious NVMe device and the execution of the openSeaChest command. No public exploitation is documented, and the risk is considered low under normal circumstances. Nevertheless, a local attacker with privileges to run the tool could cause memory corruption leading to crashes or potentially more severe effects if combined with other weaknesses.