A reachable unwrap in the __assert_fail function of relibc commit 61f42d allows an attacker to cause a denial of service by supplying a crafted string that triggers an unwrap failure during an assertion. The failure results in a panic or program crash, disrupting availability without exposing data or executing arbitrary code. The weakness is captured by CWE‑400, indicating a failure to properly enforce limits or checks.

The flaw resides in relibc, the C library used by the Redox OS operating system. Any Redox deployment or application that links against relibc at commit 61f42d or any version containing that commit is potentially affected. Exact version ranges are not enumerated, but the issue is tied to the merge request that introduced the patch. Consequently, systems using Redox without the latest relibc update may be vulnerable.

The CVSS score of 7.5 indicates moderate to high severity, while the EPSS score of <1 % suggests a very low probability of exploitation. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that an attacker who can supply a crafted string to an assertion routine can trigger the unwrap failure in __assert_fail, resulting in a program crash. The likely attack vector involves any code that calls or indirectly passes data to this assertion, such as logging, input handling, or runtime checks. The low EPSS and lack of KEV listing imply that exploitation is unlikely, but the availability impact warrants timely action.