A flaw in Striae’s hash‑validation routine allows an attacker to modify both the manifest hash and the associated package contents, causing tampered confirmation packages to be accepted as authentic. This improper validation of cryptographic parameters (CWE‑354) can lead to forensic data being altered without detection, undermining the credibility of forensic analysis performed with the tool.

Striae, a digital comparison companion for firearms examiners, is affected in all releases prior to version 3.0.0. Users running those earlier builds face the disclosed integrity bypass risk; the issue is resolved in the 3.0.0 release.

The vulnerability carries a CVSS base score of 8.2, indicating high severity, while the EPSS score of less than 1% suggests a low probability of active exploitation. It is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves delivering a crafted confirmation package to a user of Striae; if the package is accepted, the integrity check will fail to detect tampering. The exploit requires that the attacker can introduce the malicious package into the user’s workflow.