The vulnerability in TDengine’s transDecompressMsg function allows an unauthenticated attacker to trigger an out‑of‑bounds read when a compressed RPC packet is malformed. The read of the STransCompMsg.contLen field occurs without first checking that the packet actually contains the expected 8‑byte structure, leading to uncontrolled memory allocation, an integer underflow, and server crash, thereby denying service to legitimate users.

The issue affects TDengine databases deployed by TaosData that are running versions prior to 3.4.1.15. All installations of TDengine that have not applied the 3.4.1.15 update or later are potentially vulnerable.

The CVSS score of 7.5 classifies this as a high‑severity vulnerability, while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw remotely by sending a crafted RPC packet from an unauthenticated network position, which, if successful, will crash the server and cause a denial‑of‑service. No special privilege.