A nil-pointer dereference in the Sliver C2 server’s Protobuf unmarshalling logic can trigger an unhandled runtime panic when a signed message omits required nested fields. Because the mTLS, WireGuard, and DNS transport layers lack panic recovery middleware, the panic causes a global process termination. The result is an abrupt shutdown of the entire C2 infrastructure, effectively a kill‑switch that requires a manual server restart to recover. The weakness is a classic null dereference (CWE‑476).

The vulnerability affects BishopFox’s Sliver command and control framework, specifically versions 1.7.3 and earlier. No other vendors or product variants are listed as impacted.

The CVSS score is 2.1, indicating a low severity metric, while the EPSS score is below 1% and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated actor who already possesses a captured implant credential and can send a crafted protobuf message. The attack therefore targets compromised batches and can instantly compromise all sessions; however, the likelihood of exploitation is low, and the impact is limited to infrastructure availability rather than direct data theft or privilege escalation.