Perspective 5.0.0 implements a VirtualServer protocol dispatcher that allows unauthenticated remote attackers to send malformed or incomplete protobuf messages. When the dispatcher receives a message such as a ViewToArrowReq with no viewport or a MakeTableReq with no data field, it attempts to unwrap a None value at nine distinct sites, triggering a SIGABRT and terminating the process. The vulnerability is an example of improper handling of a null value (CWE‑616) and results in a denial‑of‑service with no authentication required.

The vulnerability affects Perspective by perspective‑dev, version 5.0.0. No other product versions are explicitly listed in the advisory.

The CVSS score of 8.7 indicates high severity, the EPSS score is not available, and the issue is not listed in CISA’s KEV catalog. Attackers can exploit the flaw remotely by sending crafted protobuf traffic to the VirtualServer endpoint; no prior authentication or privileged access is needed. Successful exploitation causes the server process to crash, leading to service disruption until the service is restarted or patched.