The vulnerability is a use‑after‑free in the BPv6 Fragmenter Cleanup of µD3TN. When an allocation failure occurs, an unauthenticated remote attacker can trigger the freed memory usage, causing the application to crash or become unresponsive. This results in a denial‑of‑service condition with no potential for code execution or data disclosure. The weakness is classified as CWE‑416, a classic use‑after‑free problem.

Only the D3TN GmbH µD3TN component is affected. All installations running a version prior to 0.15.2 are susceptible, as the fix is included in 0.15.2 and later. Endpoint developers should verify whether their deployment uses the 0.15.x series or an earlier major revision.

The CVSS score of 5.9 indicates moderate severity; the EPSS score is not available, so the likelihood of exploitation in the wild is unclear. The vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly known exploits. Nonetheless, the attack requires only unauthenticated remote access to the Fragmenter cleanup interface, making it potentially easy to trigger if the node is exposed to untrusted networks. Administrators should consider whether the component is exposed and mitigate accordingly.