The vulnerability resides in the GNU SASL NTLM client routine _gsasl_ntlm_client_step, where a short challenge issued by a server is not properly sanitized. This trigger sensitive data from memory, thereby compromising Improper Input Validation flaw, identified as CWE‑839.

GNU SASL versions earlier than 2.2.4 on any host that uses the NTLM authentication mechanism are affected. Systems running the library without the patch are vulnerable to a memory disclosure attack if they accept a crafted NTLM challenge from a server.

The CVSS score of 3.7 indicates moderate severity, and no EPSS value is available. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires the client to establish a TLS connection with a server that sends a crafted short NTLM challenge. An attacker controlling the server can invoke this flaw without needing elevated privileges on the client.