A weakness exists in liftoff‑sr CIPster, specifically in the forward_open function of cipconnectionmanager.cc. The argument product_code_ can be manipulated to trigger an out‑of‑bounds read. This flaw falls under CWE‑119 and CWE‑125 and enables an attacker that can reach the affected process to read arbitrary memory, potentially exposing confidential data. The CVE description indicates that an exploit is publicly available and can be launched remotely.

The vulnerability affects the liftoff‑sr CIPster component documented by the commit hash 1802525be27d33e19a9a83c163e331a1d13b1892. The advisory does not specify an explicit version number, but the patch that resolves the issue is identified by commit ea870a274bf68dfaa3f511f20e2fff6778fb7b74. Organizations running this codebase should assume that any build incorporating the offending commit is impacted.

With a CVSS base score of 6.9 the flaw is considered a medium severity issue. The EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the existence of a public exploit and the ability to act remotely elevate the practical risk. Because the attack requires only manipulation of product_code_, an adversary with network or component access can trigger the out‑of‑bounds read and obtain sensitive data.