The vulnerability resides in OpenClaw versions older than 2026.2.22. A flaw in the inbound media handling allows an attacker to upload media larger than the configured byte limit. The software accepts the oversized payload, buffers it before enforcing the limit, and consumes expanding memory. This can crash the process or consume multiple gigabytes of RAM, leading to denial of service. The weakness aligns with CWE-770, Resource Exhaustion.

Systems running OpenClaw prior to 2026.2.22 are impacted. This includes any installation of the OpenClaw application packaged with the tagged releases. No specific platform restrictions are listed, so the issue applies across all environments that deploy the vulnerable node.js code base.

The CVSS base score of 8.7 rates the issue as High. OpenClaw's own vulnerability advisory explains that no exploit code is required; the attacker only needs to transmit large media files, a capability available from any remote network. The EPSS score is not listed, and the vulnerability is not yet in the CISA KEV catalogue. As a result, the risk is high and the likelihood of exploitation is significant, especially in services that accept user uploaded media without additional infrastructure checks.