The vulnerability resides in GoAccess's parse_browser component, where a crafted User‑Agent string that starts with the Opera token can cause the program to write one to four bytes beyond the allocated heap space. This out‑of‑bounds write can corrupt neighboring memory, leading to a crash or unpredictable behavior when processing log entries. The bug is tied to memory corruption weaknesses identified as CWE‑122 and CWE‑787.

The flaw affects GoAccess version 1.10.2 running on Unix‑like operating systems or invoked through a web browser. Products distributed under the allinurl:goaccess identifier are impacted. An upgrade to version 1.11 removes the issue.

The CVSS score of 7.1 indicates moderate to high severity, but the EPSS score of less than 1% signals a low likelihood of exploitation in the near term, and the vulnerability is not yet listed in the CISA KEV catalog. The attack vector requires an attacker to supply a specially crafted User‑Agent string in an access log that GoAccess processes, which may be feasible for anyone who can influence log content. Successful exploitation could crash GoAccess or produce corrupted analysis results, disrupting log monitoring operations.