A logic error in Fleet 4.80 or earlier allows an authenticated host to trigger a crash by sending an unexpected log type to the gRPC Launcher endpoint. When the server receives this malformed request it terminates immediately, causing a full denial‑of‑service that disconnects all connected hosts, disrupts mobile device management enrollments, and breaks API consumers. The flaw is a classic unhandled exception condition, categorized as CWE‑703.

The vulnerability affects the fleetdm Fleet open source device‑management platform. Versions earlier than 4.81.0 are vulnerable; version 4.81.0 and newer contain the fix.

With a CVSS score of 6.6 the flaw has moderate severity. No EPSS score is available and it is not listed in the CISA KEV catalog, suggesting limited public exploitation data. The flaw requires a host already authenticated to the Fleet server, so an attacker must first gain local or network access to an enrolled host to send the malicious gRPC payload. Once achieved, the crash can be triggered with a single request.