The vulnerability stems from the Snort 3 SMTP MIME Decoder’s lack of bounds checking when parsing MIME fields in SMTP headers, enabling an unauthenticated remote attacker to trigger a crash of the Snort 3 Detection Engine. Successful exploitation causes the Engine to restart unexpectedly, producing a denial‑of‑service condition that can prevent proper traffic inspection until recovery occurs.

Affected Cisco products include Cisco Open Source Snort3, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco UTD SNORT IPS Engine Software. No specific version numbers are listed in the advisory.

The CVSS score of 5.8 indicates moderate severity. The EPSS score is not available, so the precise probability of exploitation cannot be quantified from the provided data. The vulnerability is not reported in the CISA KEV catalog, suggesting it is not currently known to be exploited in the wild. An attacker can exploit this flaw remotely, sending crafted SMTP packets over an established connection to the target to initiate a denial‑of‑service.