Tanium identified a use-after-free flaw in the Threat Response Client Extension. The vulnerability allows an attacker to potentially corrupt memory when the extension releases resources, which could lead to unintended behavior or code execution. The description does not explicitly state the exact outcome, but such errors typically risk compromising the integrity or availability of the affected system.

The flaw affects Tanium Endpoint Configuration Toolset Solution and the threat-response-cx product. No specific version information is provided, so all deployments of these products are potentially impacted until a patch is released.

With a CVSS score of 2.5 the vulnerability is considered low severity. EPSS data is unavailable and the issue is not listed in CISA’s KEV catalog, indicating limited known exploitation. The attack surface is unclear; it may require local access or exploitation of the Threat Response Client Extension, but the precise vector is not disclosed in the description.