An out‑of‑bounds read occurs in the Command ID 30 UDP packet handler of Lakeside SysTrack Agent’s LsiAgent.exe, allowing a remote attacker to crash the agent by sending a malformed packet. The flaw is triggered when the payload contains an invalid memory address at offset 0x4, which causes an access violation and forces the agent to terminate. Because the vulnerability leads only to a crash, it does not directly compromise confidentiality or integrity, but it disrupts the service that the agent provides.

Lakeside Software, LLC’s SysTrack Agent is affected. Versions prior to 11.2.1.28, 11.3.0.38, 11.4.0.24, and 11.5.0.15 contain the defect. All earlier releases that use the same Command ID 30 UDP handler are similarly impacted.

The CVSS score of 8.7 classifies the flaw as high severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Based on the description it is inferred that the attack can be launched remotely without authentication, by simply sending a crafted UDP packet to the agent’s listening port. The straightforward exploit leads to a denial of service that could disrupt business processes relying on the agent’s functionality.