The vulnerability resides in libevent’s tag decoder, where the function decode_tag_internal requests up to five bytes from an evbuffer but iterates logic across the full buffer, allowing a fragmented evbuffer containing a malformed six‑byte tag to read beyond the allocated region. This out‑of‑bounds read, classified as CWE‑125, can cause a crash in any process that decodes attacker‑controlled tagged RPC data, resulting in a denial of service. No evidence in the description indicates remote code execution or information disclosure.

This flaw affects libevent releases prior to 2.1.13 and the 2.2.2‑alpha line. Systems using libevent:libevent in any environment that processes tagged RPC data and is running those older versions are vulnerable. The fix is available in the 2.1.13 stable release and the 2.2.2‑alpha branch.

With a CVSS score of 8.7, the flaw is considered high severity. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog. Based on the description, an attacker can supply malformed tag data through any vector that feeds libevent encoded data, most likely a network or RPC channel. The exploit would terminate the target process, disrupting service availability. The vulnerability requires the ability to inject crafted data but does not require other privileges or additional conditions beyond interacting with libevent’s decoding functionality.