The misp-stix parser retains per‑document state that is not fully cleared when the same parser instance is reused; a malicious or intentionally crafted STIX document processed by a long‑lived parser can leave data such as galaxies, passive DNS entries, titles, dates, or custom galaxy clusters in memory, which is then incorporated into the next conversion, leading to data integrity issues where unrelated or previously secret indicators appear in subsequent MISP events and potentially exposing information that should have been restricted by different access controls.

The vulnerability affects the misp-stix component of the MISP platform; it impacts any application that imports the misp-stix API and reuses a parser instance across independent STIX documents. No specific version numbers are listed, so all releases that contain the unpatched state‑isolation logic are potentially affected.

The CVSS score of 6.3 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an attacker can influence the order of documents processed by a long‑lived parser; the threat model relies on the consuming application providing STIX input. Although no code execution or availability impact exists, the risk is significant for data integrity and, when sequential inputs have different distribution scopes, for limited disclosure.