The vulnerability arises from missing bounds checking in Mongoose’s handle_opt function. A TCP option whose length field exceeds the declared option bytes causes the code to read a byte beyond the allowed area and use that value as the low byte of the TCP Maximum Segment Size. An unauthenticated remote party can craft such malformed packets, corrupt the per‑connection MSS, and subsequently cause mg_send calls to transmit truncated or zero‑length application payloads while the connection otherwise appears healthy. This flaw does not give an attacker code execution but results in data loss or service interruption.

The issue affects the Cesanta Mongoose embedded web server and network library prior to version 7.23 when the built‑in TCP/IP stack is enabled via MG_ENABLE_TCPIP in src/net_builtin.c. Devices or applications using Cesanta Mongoose 7.22 or earlier are vulnerable.

With a CVSS score of 7.5, the flaw is considered high severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting a moderate exploitation probability. The attack vector is purely remote: an attacker only needs to send a specially crafted TCP packet from outside the network to the target. Successful exploitation results in denial of service or partial data loss of the affected connections. No privileged access is required, and the exploitation is straightforward given the missing bounds check.