The vulnerability is an out-of-bounds read in the hivex library caused by malformed large-data block lists in a Windows registry hive file. When hivex parses such a file it may read beyond the allocated buffer, causing the application that processes the hive to crash. The resulting denial-of-service limits availability. The vulnerability does not specify any impact on confidentiality or integrity.

Hivex is used in Red Hat Enterprise Linux releases 10, 6, 7, 8, and 9. All of those distributions contain the vulnerable component. The advisory does not list specific component versions, so the flaw applies to the hivex package shipped with each of the mentioned RHEL releases.

The CVSS score of 2.0 reflects a low severity impact, and no EPSS score is available; the vulnerability is not listed in the CISA KEV catalog. Based on the description it is inferred that an attacker would need to deliver a specially crafted Windows registry hive file to a system that processes the file, for example via email attachment or file upload. Once the vulnerable file is parsed by hivex the out-of-bounds read triggers a crash, denying service to the affected application.