The vulnerability arises from an out‑of‑bounds read in the mpls_do_error function, triggered by receiving an MPLS frame that contains 16 labels and lacks the Bottom‑of‑Stack bit. This flaw allows an attacker to read portions of the kernel stack, which could expose sensitive kernel data and assist further attacks. The flaw is classified as CWE‑125 and is reflected in a CVSS score of 6.9, indicating a moderate level of risk.

Any OpenBSD system running the openbsd:src code base prior to the inclusion of commit 6a23123 (dated 2026‑06‑18) is affected. The patch is incorporated in later OpenBSD releases, so all builds before that commit are vulnerable.

The attack requires network access to the target and the ability to craft MPLS packets. While the exploit does not grant direct code execution, the exposure of kernel stack contents could be leveraged with other vulnerabilities for privilege escalation. The EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting that it may not yet be widely exploited in the wild. Nonetheless, the moderate CVSS score and the nature of the information disclosed warrant prompt attention.