Squid, the web caching proxy, contains an out‑of‑bounds read in its ICP message handling. When a client sends a malformed ICP request, Squid copies a small amount of memory into an error response before it has validated the input. The copied data may include confidential information, such as credentials or configuration snippets. The flaw is a classic buffer over‑read (CWE‑125) caused by improper input validation (CWE‑1289).

The issue affects Squid implementations that enable ICP support – that is, when the configuration parameter `icp_port` is set to a non‑zero value. All Squid releases prior to version 7.5 are vulnerable, including the widely deployed 7.0, 7.2 and early 7.4 series. Systems that have disabled ICP or left the default port unchanged are not impacted.

The CVSS score of 6.9 indicates a moderate severity. EPSS scoring shows an exploitation likelihood of less than 1 %, and the vulnerability is not listed in the CISA KEV catalog. Exploitation can be carried out from any remote host that can reach the ICP port, by sending specially crafted requests that trigger the out‑of‑bounds read. The result is information disclosure; there is no evidence of code execution or other escalation. The recommended mitigation is to upgrade to Squid 7.5 or later, or to disable ICP if it is not required.