The vulnerability in Splunk Enterprise stems from improper control of a resource through its lifetime, as classified by CWE‑664. This weakness can allow an attacker to influence how the system allocates, uses, or releases critical resources such as memory, file descriptors, or threads. If exploited, an attacker could potentially cause the application to deallocate resources prematurely, leak resources, or overload the system, leading to performance degradation or a complete denial of service. The description does not detail an explicit exploitation scenario, but the nature of the flaw strongly suggests that resource exhaustion or service instability could result.

Splunk Enterprise deployments running any of the vulnerable releases listed in the advisory – versions 10.4.3, 10.2.7, 10.0.10, and 9.4.15 – are impacted. The fix is available in these releases and any newer version of Splunk Enterprise.

The CVSS rating of 8.8 indicates high severity. The EPSS score of less than 1% denotes a low likelihood of exploitation in the wild, and the vulnerability is not included in the CISA KEV catalog. The lack of explicit attack vector details in the advisory means the exact exploitation method is unspecified; however, it is reasonable to infer that an attacker with sufficient privileges or that can influence Splunk processes might exploit the flaw to deplete resources or disrupt service. Consequently, the risk remains significant, especially in environments where Splunk processes run with elevated privileges or lack explicit resource limits.