The vulnerability arises from an out‑of‑bounds write into an alloca‑allocated array on the stack inside the glibc tdelete function, a classic stack‑based buffer overflow identified as CWE‑121 and CWE‑787. If triggered, the flaw corrupts memory which can lead to a denial of service or accidental disclosure of data. Exploitation requires a tree with a depth of exactly 40 (or 40 plus a multiple of 20), meaning the attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete, and the flaw may crash the application.

The flaw affects the glibc library, which is a core component of many Linux distributions. No specific versions are listed in the advisory, so any system using an affected glibc build from the listed reference URLs is potentially impacted.

With a CVSS score of 5.6 the severity is moderate. Exploitation conditions require the attacker to perform many insertions and deletions through an application that uses tsearch and tdelete, and the flaw may crash the application. The EPSS score is not available, so the likelihood of exploitation remains unknown. The vulnerability is not listed in the CISA KEV catalog, indicating it has not been witnessed in widespread deployment reports as of the last update.