An unauthenticated user with network access can exploit an integer overflow flaw to execute arbitrary code on the ClickHouse Server. This leads to a full compromise of the system, exposing the confidentiality, integrity, and availability of data and services.

All ClickHouse Server installations are susceptible. The vulnerability applies to the server component from the ClickHouse vendor with no specific version limitations disclosed.

With a CVSS score of 9.5 this weakness is considered critical. EPSS is not available, but the absence of a score does not mitigate the threat. An unauthenticated attacker can reach the ClickHouse service over the network and trigger the overflow, with no authentication required. The vulnerability is not yet listed in the CISA KEV catalog.