Packetbeat contains improper validation of array indices in multiple protocol parser components, leading to out‑of‑bounds read operations. A malicious actor can craft malformed network packets that cause Packetbeat to crash or exhaust system resources, resulting in denial of service. The weakness is classified as CWE‑129, and the effect is restricted to the application process, potentially affecting the availability of monitored services on the affected host.

The vulnerability affects the Elastic Packetbeat product. No specific version information is provided in the official advisory, so all currently deployed instances may be vulnerable until a patch is applied.

The CVSS score is 5.7, indicating moderate severity, while the EPSS score is below 1%, suggesting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is network based; an attacker must send specialized packets to a monitored interface or control traffic on the same network segment as Packetbeat. If these conditions are met, the attacker can trigger the crash or resource exhaustion.