A race condition between the optional report buffer’s cleanup routine and regular transcript writes can erase or corrupt stored transcripts. When the cleaning routine rewrites the file without proper locking, concurrent writes can be lost or duplicated, allowing retention limits to be bypassed. The resulting corruption can cause the storage file to grow without bound, eventually exhausting disk space and crashing the host or other services that share the storage. This flaw permits a Denial of Service without privilege escalation, because any user who can generate or trigger report buffer writes participates in the race.

VoiceSentinel products from versions 2.2.1 through 3.3.1 that have the report_buffer feature enabled are impacted. The default installation disabling this feature is not affected, but any opt‑in configuration that sets "report_buffer.enabled" to true is vulnerable.

The CVSS score of 8.2 indicates high severity. Explicit EPSS data is not available, and the vulnerability is not listed in CISA KEV, but the lack of a mitigation path and the potential for indiscriminate storage exhaustion means it remains a practical risk. Attackers can trigger the condition by creating normal report buffer writes through legitimate server activity or by manipulating the shared server key in public‑pool configurations, revealing a likely internal attack vector. Once the race occurs, it is difficult to recover without a fresh file, making it a classic denial‑of‑service flaw.