The mmpstrucdata plugin in rsyslog treats RFC5424 structured‑data parameter values using a fixed stack buffer of 32 kB within the parseSD_PARAM routine. The downstream parsePARAM_VALUE function is called without a bound on the destination buffer, allowing a structured‑data field larger than the buffer to overwrite adjacent stack memory. The vulnerability only appears when the optional plugin is enabled, the message‑size limit (MaxMessageSize) permits a message with such a field, and the malformed log entry reaches an mmpstrucdata action. The CVE report indicates that a crafted message causes the rsyslog process to crash, interrupting log collection; an attacker‑controlled overwrite is possible but a code‑execution exploit has not been demonstrated.

Affected systems are rsyslog releases from 7.5.4 up to, but not including, 8.2606.0, inclusive; any deployment that includes the optional mmpstrucdata plugin and applies it via an action is potentially vulnerable when the MaxMessageSize configuration allows large RFC5424 messages. Deployments that omit the plugin entirely or enforce a message‑size limit below the overflow threshold are not affected by this issue.

The published CVSS score of 8.1 reflects a high severity; the EPSS score is not available and the vulnerability is not listed in CISA KEV, indicating no public evidence of exploitation yet. The attack vector is remote: an unauthenticated external host that can inject a crafted RFC5424 message to a rsyslog instance. Although the buffer overflow could in theory allow an attacker to overwrite return addresses or other control data, the CVE documentation shows only a denial‑of‑service manifestation. Therefore, the principal risk is disruption of log collection, with a potential – but not proven – risk of code execution.