The SICAM SIAPP SDK does not enforce maximum length checks on certain client variables. An attacker can transmit an oversized input that causes a stack overflow, leading to a process crash and a denial‑of‑service condition. This flaw directly compromises availability without affecting confidentiality or integrity.

Siemens SICAM SIAPP SDK, versions earlier than 2.1.7. The vulnerability applies to all affected deployments of this SDK component.

The CVSS score of 5.9 indicates a moderate severity. The EPSS score is below 1%, suggesting a very low likelihood of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog, and no active exploit has been reported. The attack vector is likely remote or local client‑side input, inferred from the description that the flaw occurs in the client component when receiving oversized data. An attacker would need to supply the crafted input to trigger the stack overflow, which would then crash the process. Given the low exploitation probability, immediate patching is still recommended due to the availability impact.