The vulnerability lies in CodeChecker's massStoreRun, which performs one‑shot decompression of Base64‑encoded zlib data from an authenticated user. The decompressed output is fully materialized in memory before being written to a temporary file, and no limit is applied to the decompressed size. An attacker who can submit a highly compressed payload that expands to a large byte sequence can thus exhaust process or host memory and consume significant disk space, leading to a denial of service.

The affected product is Ericsson CodeChecker. No specific version information is supplied in the advisory.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. The attack requires an authenticated user with permission to store analysis runs, so the attacker must have valid credentials, likely a local or remote authenticated session. Once the large payload is processed, the memory and disk exhaustion symptoms occur, and the system becomes unresponsive. The lack of a publicly known exploit or high EPSS suggests a moderate likelihood of exploitation, but the potential impact remains significant if an attacker gains the required privilege.