snac2 prior to version 2.93 contains a heap‑based buffer overflow in the JSON lexer function. The overflow is triggered by JSON strings that include a null escape sequence, allowing an attacker to corrupt heap memory. This corruption can cause the server to crash, resulting in an inability to process legitimate requests and effectively denying service to users.

The vulnerability affects products from grunfink:snac2 running any release before 2.93. Versions 2.93 and later have the fix applied, removing the buffer overrun in the JSON parsing routine.

The vulnerability carries a CVSS score of 8.7, indicating high severity. EPSS data is not available, so the current probability of exploitation is unknown, but the attack requires only unauthenticated remote access and the ability to send an activitypub POST request containing the crafted JSON before signature validation. The vulnerability is not listed in CISA KEV, though attackers could still exploit it via simple HTTP POST to the activitypub endpoint without any user credentials.