The vulnerability results from flawed buffer handling logic when processing DCE/RPC requests within the Snort 3 Detection Engine. A malicious actor can send specially crafted or a large volume of DCE/RPC frames, triggering an out‑of‑bounds read that allows the engine to expose sensitive data from the packet inspection stream or to crash, leading to a disruption of packet inspection services. This leads to partial information disclosure and a potential denial of service, as outlined by CWE‑200.

Cisco Secure Firewall Threat Defense (FTD) Software and Cisco UTD SNORT IPS Engine Software are the products impacted by this error. No specific version range is disclosed in the advisory, so any installation of the affected components without a patch should be considered at risk.

It is rated medium level severity with a CVSS score of 5.3 and an EPSS score of less than 1 %, indicating a low likelihood of exploitation in the wild. The advisory confirms that the attack can be performed remotely by an unauthenticated attacker, without the need for privileged access or special credentials. The vulnerability is not listed in the CISA KEV catalog, which further reflects its lower systemic threat posture.