A double‑free and use‑after‑free flaw exists in NFS‑Ganesha when a READ reply is cached in the session‑slot replay cache for an NFSv4.1 COMPOUND request. The server frees the READ data buffer during the first transmission but retains a dangling pointer in the cache. When a legal protocol replay later re‑sends the data, the freed buffer contents are transmitted again and the dangling pointer is freed a second time, which can lead to remote heap information disclosure and a crash of the NFS‑Ganesha daemon, resulting in service interruption.

The vulnerability affects all installations of NFS‑Ganesha that enable NFSv4.1 session‑slot replay caching. The specific product is NFS‑Ganesha; no version information is provided, so any deployed instance is potentially vulnerable.

The CVSS score of 8.1 indicates a high severity and the failure to appear in the CISA KEV catalog does not diminish the risk. Because the exploit requires an NFS client that can issue a replayable NFSv4.1 COMPOUND request against the vulnerable server, the attack vector is inferred to be remote over the NFS protocol. Without a publicly known exploit, the EPSS is not available, but the nature of the vulnerability—heap memory corruption that can disclose information and crash the daemon—suggests that a motivated adversary could achieve data leakage and denial of service if the server is reachable and the feature is enabled.