An attacker who can authenticate to a Sliver C2 server or has taken control of an implant can send specially crafted 4‑byte length prefixes over the mTLS or WireGuard transport. The socketReadEnvelope and socketWGReadEnvelope functions use these prefixes to allocate a buffer, and because ServerMaxMessageSize is configured to allow allocations near 2 GiB, a single malicious prefix can cause the server to request several hundred gigabytes of memory. The resulting out‑of‑memory condition triggers the operating system to kill the Sliver process, taking down all active implant sessions and potentially affecting other services running on the same host. This weakness matches CWE‑770 and CWE‑789, which describe uncontrolled allocation and missing bounds checking.

BishopFox Sliver, versions 1.7.3 and earlier.

The CVSS score of 5.7 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild and the vulnerability is not listed in CISA’s KEV catalog. Successful exploitation requires legitimate credentials or a compromised implant; an attacker then needs to transmit up to 128 concurrent Yamux streams with fabricated length prefixes to reach the allocation limit. When triggered, the exploit causes a denial‑of‑service that disrupts the C2 server and may cause collateral damage to other processes on the host. Due to the authentication requirement, the risk is moderate for environments running unpatched Sliver, but a compromised implant elevates the threat level for any organization relying on those implants.