CGNS through version 4.5.2 contains a stack out‑of‑bounds read in the function ADFI_read_node_header. The vulnerability is triggered when a crafted .cgns or .adf file has a non‑NUL‑terminated end tag, causing the internal routine ADFI_stridx_c to read past the allocated buffer and read uninitialized stack memory. The resulting memory read can lead to a crash of any application that consumes the malformed file, such as the CGNS command‑line tool cgnslist.

All installations of the CGNS library version 4.5.2 and earlier are affected. The issue originates in the shared library code used by all CGNS tools, so any deployment of CGNS 4.5.2 or earlier is potentially impacted.

The CVSS score of 4.8 indicates a moderate impact severity. Because the exploit is achieved by supplying a malicious file, it requires local access or an untrusted file source, meaning the vector is likely local or untrusted input. The EPSS score of <1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not been widely exploited yet. An attacker who can influence the file processed by a CGNS‑based tool can cause a denial‑of‑service by crashing the application.