Yamux, a stream multiplexer built over TCP/IP, has a flaw in sending window accounting that can be triggered by a specially crafted WindowUpdate packet. The arithmetic overflow causes a panic in the connection state machine, resulting in a crash of the affected process. This vulnerability is exploitable remotely via a normal network connection and does not require authentication, leading to a denial of service for any application using the vulnerable library.

The vulnerability affects the libp2p:rust-yamux package versions ranging from 0.13.0 up to but not including 0.13.9. The specific CPE identifier is cpe:2.3:a:protocol:yamux:*:*:*:*:*:rust:*:*.

The CVSS score of 8.7 classifies this as a high severity issue. The EPSS score of less than 1% indicates a low overall probability of exploitation, and the vendor has not listed it in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires only the ability to send a maliciously crafted WindowUpdate over a network connection to the target. Successful exploitation results in a program crash, causing denial of service for the affected process and potentially impacting connected peers. The vulnerability is exploitable without credentials and can be delivered over any active TCP/IP session that uses Yamux.