The vulnerability resides in the MerkleRadixTrie::put_chunk function of the Nimiq core-rs-albatross implementation. A remote, unauthenticated attacker can send specially crafted ROOT-keyed trie chunks that cause a panic in the node, resulting in a crash. This leads to a denial-of-service condition, allowing attackers to disrupt a node’s availability during state synchronization. The weakness is classified as CWE-248, an improper null termination issue that can be triggered during trie processing.

The affected product is nimiq:core-rs-albatross. Versions older than 1.5.0 are vulnerable. The vulnerability was fixed in release 1.5.0, so any deployment using that version or later is not impacted.

The CVSS score of 7.5 indicates a high severity. EPSS data is not available, so the current exploitation probability cannot be quantified, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a remote state-sync peer that can send malicious trie chunks without authentication.