The vulnerability lies in the Snort 3 Generic Routing Encapsulation (GRE) detection engine, where insufficient error checking during GRE packet parsing can lead an unauthenticated, remote attacker to cause the Snort 3 detection engine to restart. This restart interrupts packet inspection, effectively creating a denial‑of‑service condition. The weakness is classified as CWE‑128, indicating an improper error handling issue.

Affected products include Cisco Open Source Snort 3, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco UTD SNORT IPS Engine Software. The CVE advisory does not list specific firmware or software release numbers, so all baseline installations of these products remain susceptible until an official patch or version update is applied.

The CVSS score of 5.8 indicates moderate severity, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation campaigns yet. An attacker can send a crafted GRE packet over any network path that reaches the device. Successful exploitation would only impact the availability of packet inspection services on the targeted device, not enabling lateral movement or data theft. The risk is therefore moderate, contingent on the presence of GRE traffic and the exposure of the affected system to the broader network.