A security flaw in the TCP Encapsulation Receive Path of liftoff‑sr CIPster allows an attacker to trigger an out‑of‑bounds read by manipulating packet data. The bug is located in source/src/enet_encap/encap.cc and can be exercised remotely over the network. An out‑of‑bounds read can expose portions of memory not intended for disclosure, leading to potential information compromise or a crash that could be chained into a more serious attack. The weakness maps to CWE‑119 and CWE‑125, representing a buffer overflow/statement in improper bounds checking.

The vulnerable component is liftoff‑sr CIPster, specifically the commit 1802525be27d33e19a9a83c163e331a1d13b1892. No other product variants or version ranges are listed, so the focus should remain on this build of CIPster.

The CVSS score of 6.9 indicates high severity; the EPSS score is not available, so exploitation probability is uncertain. The vulnerability is publicly disclosed and may be used by adversaries. It is not listed in the CISA KEV catalog, but the nature of the flaw suggests a need for prompt mitigation. Attackers can trigger the exploit remotely by crafting malformed encapsulation packets. Because the bug involves a read beyond buffer bounds, success does not guarantee code execution, though the resulting information leakage could aid further attacks.