ReadFile in the gmrtd Go library currently accepts TLV lengths of up to 4GB, leading to uncontrolled memory allocation and CPU consumption. An attacker can exploit this by sending a malformed TLV, causing the library to allocate or iterate many 256‑byte chunks and stall the goroutine. The result is a denial of service, aligning with CWE‑400 (Uncontrolled Resource Consumption) and CWE‑770 (Out‑of‑Bound array read).

The vulnerable code resides in the gmrtd Go library used to read Machine Readable Travel Documents. Any application that imports this library and reads data from NFC or other transports is impacted. Versions earlier than 0.17.2 are affected; the patch was shipped in release 0.17.2.

The CVSS score of 5.9 indicates a moderate impact, but the EPSS score of less than 1% shows a very low likelihood of active exploitation. The vulnerability is not in CISA’s KEV catalog. Attackers can trigger the issue by delivering a malicious NFC tag that emits TLVs with excessive lengths, which the library will process, consuming memory and CPU. This is a remote denial‑of‑service vector that can affect any device that reads contactless data through the library.