The vulnerability is a heap out-of-bounds read in the ms3_detect() function of libmseed. A malformed miniSEED 2 record whose header is validated but whose buffer is too short allows the function to read up to eight additional bytes beyond the end of the allocated memory. This read can expose data from adjacent heap locations and can trigger a crash of the consuming application, resulting in a denial of service.

EarthScope's libmseed library is affected through version 3.5.4. Any installation that includes this library, such as seismic data processing tools that embed libmseed, is potentially vulnerable. The fix is available in later releases.

The CVSS score of 6.8 indicates moderate to high severity. The EPSS score is below 1%, indicating that the vulnerability is currently considered unlikely to be actively exploited in the wild, and it is not listed in CISA's KEV catalog. Exploitation requires an attacker to supply a specially crafted 40‑47 byte buffer that passes an MS2_ISVALIDHEADER check and then calls msr3_parse or ms3_detect. Thus, the most probable attack vector is local, where the attacker can control the input that the library processes. A successful exploit could lead to a crash of the consuming application and, depending on the heap layout, possible leakage of memory contents.