This vulnerability manifests as a heap‑based buffer overflow triggered by a sign‑extension flaw in the SOCKS5 domain name reply parser. A malicious SOCKS5 proxy can supply a domain name length that, when read into a signed char, produces a negative value converted to an unsigned size_t, allowing an attacker to write beyond the 262‑byte reply buffer and corrupt adjacent heap memory. The consequence is uncontrolled memory corruption that could lead to arbitrary code execution or a crash, as defined by CWE‑122.

All releases of socat from 1.8.0.0 through 1.8.1.1 are affected. The vulnerability exists in the standard socat binary distributed by the socat project. Users of these versions should verify the currently installed release number.

The CVSS score of 9.2 indicates critical severity, and although an EPSS score is not available, the known ability to trigger the overflow via a remote SOCKS5 server makes the risk high for services that rely on socat for proxying. The vulnerability is not listed in the CISA KEV catalog, but its remote nature and high severity would make it a priority for immediate remediation. Attackers would need control over a SOCKS5 proxy that a socat user connects to, and could then send crafted replies to corrupt memory.