The vulnerability arises because the path index column inside profile dump files is not bounded. An attacker can craft a dump with an excessively large index, and when the parser processes it it allocates an array of that size, draining available memory and potentially causing the application to crash.

The affected component is the HMBRAND DBI::ProfileData Perl module. All installations of this module with a version earlier than 1.651 lack the path index bound check and are therefore susceptible. Systems that load or parse profile dump files with this older module are impacted.

The CVSS score of 7.5 indicates a medium‑to‑high severity risk. The EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker who can supply a crafted profile dump file can trigger excessive memory consumption, leading to denial of service. The impact is limited to availability, with no known compromise of confidentiality or integrity.