The vulnerability is a stack-based buffer overflow, a CWE-121 condition, in the SCRAM_Hi function of the libstrophe library. An attacker who controls an XMPP server can send a server‑first‑message containing an SCRAM salt that, when decoded, exceeds 124 bytes. This overflow can abort the client or overwrite stack memory, potentially allowing arbitrary code execution.

The issue affects the libstrophe library from all releases up through 0.14.0. Systems that link against libstrophe for XMPP client functionality are impacted, regardless of the vendor of the host application.

With a CVSS score of 6, the vulnerability is classified as moderate. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits at this time. The attack requires a malicious XMPP server that can send a specially crafted SCRAM salt, indicating the attack vector is a malicious network provider or an adversary who can play the role of an XMPP server. Because the overflow occurs on the client side, the risk is limited to that client; however, if the client is exposed to untrusted servers, the threat is real.