The vulnerability resides in the HLL unpacking routine of openGauss-server. An attacker can craft a packed HLL payload where lenTotal is smaller than lenUsed. The function incorrectly validates only the header length, allocates a buffer of size lenTotal, and copies lenUsed bytes using memcpy_s with a target size of lenUsed. This mismatch allows an out‑of‑bounds write that corrupts heap memory, potentially leading to data corruption or a service crash. The flaw is triggered via standard database connections and through the SQL functions hll_in, hll_print, and hll_cardinality.

Affected products are openGauss-server from version 2.1.0 through 6.x, plus the release‑candidate builds 7.0.0‑RC1 to RC3. All of these versions contain the defective HLL unpacking path. The fix was first introduced in the 7.0.0‑LTS release, which enforces a lenUsed <= lenTotal check and corrects the memcpy_s destination size.

The CVSS score of 8.1 indicates high severity. EPSS is not reported, and the vulnerability is not listed in the CISA KEV catalog. The flaw can be exploited by a normal database user by sending a malformed HLL literal, such as via the ::hll cast. No public exploit is known, but the potential for arbitrary heap memory overwrite makes the attack path dangerous.