The vulnerability resides in polkit’s polkit-agent-helper-1 setuid binary, which reads data from standard input without limiting the input size. A local user can supply a specially crafted, excessively long stream that forces an out‑of‑memory condition, causing the helper process to crash and leading to a denial‑of‑service for the system. The flaw corresponds to resource‑consumption overuse (CWE‑770).

Red Hat Enterprise Linux releases 6, 7, 8, 9, and 10, as well as Red Hat OpenShift Container Platform 4 are impacted. Installation of the affected packages on these platforms exposes the system to local memory‑exhaustion attacks that can bring services to a halt.

The CVSS score of 5.5 classifies the issue as moderate severity. No EPSS data or KEV listing is available, indicating that exploitation has not been widely observed yet. The attack vector is local, requiring a user that can execute commands with the privileges of the setuid binary, and the exploit would only cause service disruption without compromising overall system confidentiality or integrity.