OpenTelemetry eBPF Instrumentation, from version 0.7.0 up to, but not including, 0.9.0, contains an issue in the log enricher component where writev buffers are mishandled. The implementation reads only the first iovec entry but uses the total iov_iter.count as the copy length, enabling a crafted multi‑segment writev call to cause the program to read and overwrite memory beyond the first buffer. This memory corruption could potentially alter application state or leak sensitive data if the overwritten region influences subsequent processing.

The affected product is OpenTelemetry eBPF Instrumentation (open‑telemetry:opentelemetry‑ebpf‑instrumentation). Versions from 0.7.0 through all releases preceding 0.9.0 are impacted. The vulnerability was fixed in release 0.9.0.

The CVSS score of 4.9 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The known vector is a crafted writev call that requires the log enricher to be enabled; it is unclear from the advisory whether external entities can trigger the writev, so the attack surface is likely limited to environments where log injection is enabled or where an attacker can influence the log content. No exploit has been reported. The risk is therefore moderate but ties closely to the presence of log injection and the version in use.