A memory allocation error allows an attacker without authentication to force the Trane Tracer family of controllers to crash or reboot, resulting in an interruption of HVAC services. The flaw arises from an unchecked size parameter during allocation, a classic uncontrolled memory allocation weakness classified as CWE-789. An attacker who can trigger the faulty allocation can cause a denial-of-service condition that disrupts normal building climate control operations and potentially leads to occupant discomfort or equipment damage.

The vulnerability affects Trane's Tracer Concierge, Tracer SC, and Tracer SC+ products. Firmware versions listed in the Common Platform Enumeration include Trane Tracer SC firmware 4.4 with service packs 1 through 6, and the corresponding Tracer SC+ firmware. The vendor has issued a fix in Tracer SC+ version v6.30.2313, which supersedes earlier releases.

With a CVSS score of 8.7 the flaw is considered high severity, yet the EPSS score is below 1% and the issue is not catalogued in the CISA KEV list, indicating low current exploitation probability. The vulnerability can be triggered by any entity that can reach the control interface without authentication, implying a remote network attack vector, though the description does not specify the exact channel. An attacker could exploit it to bring the system down, causing significant operational disruption.