Tanium reported a heap-based buffer overflow flaw within its Index component. The vulnerability occurs when untrusted input is processed by Index, allowing an attacker to corrupt heap memory. While the description does not confirm that this flaw directly leads to arbitrary code execution, a heap overflow can potentially lead to memory corruption issues that may be exploitable by an attacker.

The flaw impacts Tanium Endpoint Configuration Toolset Solution and the Tanium:index-cx product. No specific patch versions or vulnerable releases are listed, so all deployed instances of these products are considered at risk until a patch is applied.

The CVSS score of 7.8 categorizes this issue as high severity. The EPSS score is currently not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no known active exploitation. Based on the description, the likely attack vector is network-based; an attacker would need to deliver malicious data to the Index service, which likely requires the target to be reachable over the network and the service to accept external input. Successful exploitation could potentially allow an attacker to corrupt memory or achieve other unintended actions, depending on the permissions of the service process.