The vulnerability arises from an unchecked type assertion in Kyverno's buildStatementMap routine, which causes a panic when the engine processes a crafted attestation statement containing a non‑string type field. An attacker can exploit this by pushing an OCI referrer manifest with the malicious field, resulting in a crash of the policy engine or a crash‑loop of the reports‑controller, thereby disabling image verification when the failurePolicy is set to Ignore.

The affected product is Kyverno Kyverno. Versions prior to 1.19.2 are vulnerable. This includes all releases older than 1.19.2.

The CVSS score of 8.7 indicates high severity. EPSS data is not available, and the vulnerability is not yet listed in CISA's KEV catalog, so the current exploitation probability is uncertain. Based on the description, the likely attack vector is remote: an unauthenticated attacker who can submit a crafted OCI referrer manifest to a registry or API that Kyverno consumes can trigger the crash. Once the policy engine crashes, image verification is bypassed or the reports‑controller becomes unavailable, causing a denial of service for the governed workloads.