libsmi 0.5.0 contains an out-of-bounds write in the smiValueAsString function, allowing an attacker to overflow a 1024‑byte static buffer by hex rendering an OCTET STRING DEFVAL of 512 or more bytes that begins with a null byte. This overflow corrupts adjacent global variables and can crash the smidump utility or other consumer applications. The vulnerability does not directly provide a code‑execution path but can be leveraged to disrupt service or potentially modify memory if the target process has sufficient privileges.

The only affected product is amartin755 libsmi, version 0.5.0. All earlier versions are also exposed to the same issue.

The CVSS score of 6.9 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers must supply a crafted MIB file that contains a large OCTET STRING DEFVAL with a leading 0x00 byte, so the most likely attack vector is local or controlled by a user who can provide such a file to the library. Because the flaw only causes a crash or memory corruption, exploitation is limited to denial of service unless the attacker can influence privileged memory regions.