The flaw lies in claircore's apk package scanner, where malformed package‑database data in a container layer can trigger an out‑of‑bounds read. This out‑of‑bounds access causes a panic that, if not recovered, crashes the Clair indexer process. The result is a denial of service that interrupts vulnerability scanning for clouds or clusters managed by Red Hat Advanced Cluster Security or Quay. The weakness is a classic example of CWE‑125, a buffer under-read that leads to program instability.

The vulnerability affects Red Hat Advanced Cluster Security 4 and Red Hat Quay 3. No specific sub‑version ranges are listed, so all instances of these product versions are potentially impacted.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of <1% indicates a low likelihood of exploitation. Based on the description, it is inferred that an attacker could supply a container image with crafted package‑database data— for example by pushing a malicious image to a registry or tampering with a layer on a trusted registry— to trigger the out‑of‑bounds read. If the panic is not recovered, the Clair indexer process crashes, causing a temporary loss of scanning capability. The flaw is not listed in the CISA KEV catalog, and no patch is currently available, so mitigations must rely on limiting indexing traffic and isolating failures.