Hazelcast versions prior to 5.4.5, 5.5.10, and 5.6.1 exhibit an improper validation flaw that permits a malicious client to access a cluster member’s Java heap, off‑heap data, and entire JVM address space. This misvalidation can cause arbitrary memory reads, crash cluster members, and in certain Enterprise Edition configurations corrupt memory, creating a potential pathway to remote code execution. The weakness is classified as CWE‑20 and CWE‑125, reflecting unsafe input handling and bounds‑checking errors.

Both Hazelcast Community and Enterprise distributions are impacted. All installations of Hazelcast before the following releases are vulnerable: 5.4.5, 5.5.10, and 5.6.1. The issue is resolved in Hazelcast 5.4.5, 5.5.10, 5.6.1, and 5.7.0. No other vendors or products are listed as affected.

The CVSS score of 9.3 signals a high severity risk. While the EPSS score is not available, the lack of inclusion in the CISA KEV catalog does not diminish the critical nature of the flaw. Attackers can exploit this by connecting as a low‑privileged client to the cluster over the network; no special privileges are required, making the threat surface large. Based on the description, the vulnerability can be leveraged to read sensitive data, crash services, and potentially achieve remote code execution.