Out‑of‑bounds write in the packet processing module of Xquic Server can lead to a buffer overflow that, if triggered by a malicious QUIC packet, may corrupt memory and potentially allow code execution or denial of service. The vulnerability is classified as CWE‑787 and is reported to have a CVSS score of 6.6, which indicates a moderate severity. The description does not explicitly state the attacker’s capabilities, but the vulnerability is tied to network‑bound QUIC traffic, so the likely attack vector is remote, from an external attacker able to craft malicious packets.

The issue affects the Xquic Server component of the Xquic Project on Linux. All releases through version 1.8.3 are vulnerable; versions from 1.8.4 onward contain the fix.

The CVSS score of 6.6 is moderate, but the EPSS score is below 1%, indicating a very low exploitation probability at this time. The vulnerability is not listed in the CISA KEV catalog, which further suggests limited exploitation activity. Nevertheless, because the flaw can be triggered remotely, it poses a potential threat if an attacker obtains focused knowledge of the affected deployment. The absence of a publicly available exploitation kit reduces the likelihood of widespread attacks, yet security teams should remain vigilant.