The vulnerability is a heap‑based buffer overflow in xdgmime, caused by incorrect pointer arithmetic when parsing a MIME magic file line on little‑endian systems. The overflow writes two bytes beyond the intended buffer, leading to application crashes or memory corruption. An attacker may trigger memory corruption or cause the application to crash, potentially enabling further exploitation if additional vulnerabilities are present.

Red Hat Enterprise Linux 10, 7, 8, and 9 contain the vulnerable xdgmime component, and any distribution that ships the xdg:xdgmime package is affected. The vulnerability manifests when an attacker supplies a crafted MIME magic file in a user‑writable XDG data directory such as $XDG_DATA_HOME/mime/magic.

The CVSS score of 7.1 indicates moderate to high severity, while the EPSS score of < 1% suggests a low but not zero chance of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires write access to a user’s XDG data directory and is likely local; however, if a malicious file is placed in an environment where MIME detection code runs under other users’ contexts, the impact could spread beyond the local user.