The vulnerability in Tanium’s Threat Response Client Extension permits an attacker to read data beyond the bounds of a buffer, resulting in the disclosure of sensitive information. Because this flaw is an out‑of‑bounds read, any data that resides adjacent to the targeted buffer may be exposed. The CVE provides no indication that the flaw can be used to execute code or modify data; its impact is limited to confidentiality loss.

This weakness affects Tanium Endpoint Configuration Toolset Solution and the Tanium Threat Response Client Extension. No version details were supplied in the advisory, so all currently deployed versions are potentially vulnerable until an update is applied.

The CVSS score of 3.6 classifies the issue as low‑to‑moderate severity. The EPSS score is not available, so the likelihood of exploitation is unclear. The vulnerability is not listed in the CISA KEV catalog, indicating no known active exploits. Attackers would need to target a system running the affected client, likely requiring local or privileged access to the software. Given the limited scope, the risk to an organization depends largely on how the Threat Response Client Extension is configured and accessed by users.