The vulnerability originates from dpkg-deb, a component of Debian's packaging system, which fails to validate the end of a data stream when decompressing zstd‑compressed .deb archives. This oversight can cause the decompression routine to enter an infinite loop, consuming 100% CPU and leading to a denial of service on the affected system. The weakness aligns with CWE‑835, reflecting uncontrolled resource consumption.

Affected products are all Debian systems using the dpkg package manager, particularly the dpkg‑deb component. The CVE does not list specific affected versions, so any Debian release prior to the application of the zstd stream validation patch is potentially vulnerable. Users should check their dpkg version against the repository to confirm if the patch is present.

The CVSS score of 7.5 indicates a high severity, but the EPSS score of less than 1% suggests exploitation probability is low at present. The vulnerability is not in CISA's KEV catalog. Attacks would require an attacker to supply a malicious .deb file that is decompressed, which can occur during package installation or update operations. Because the flaw is triggered during decompression, administrative or root privileges are typically required, but local process elevation or compromised update services could also facilitate exploitation.