The vulnerability involves a malicious BuildKit client or frontend that can construct a request causing the BuildKit daemon to crash by triggering a panic. Because the crash terminates the daemon, it results in a denial of service that impacts any system relying on the BuildKit service. The weakness is a failure to validate input parameters and is classified as CWE-20.

The affected software is moby's BuildKit, an open-source build system that powers Docker and Kubernetes build workflows. No specific product versions were identified in the CNA data, so any installation that employs BuildKit frontends could be vulnerable. The issue arises whenever an untrusted frontend is executed, whether through a #syntax declaration in a Dockerfile or via the --frontend flag with buildctl.

The CVSS score of 6.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. BuildKit is not listed in CISA's KEV catalog, so there are currently no known public exploits. Based on the description, the most likely attack vector is that an attacker sends a crafted build request to a BuildKit daemon that is exposed to the network or accessed by untrusted frontends, causing the daemon process to abort. Because the fault lies in input handling, the impact is limited to the availability of the build service rather than data confidentiality or integrity.