An out‑of‑bounds read exists in the TLS ClientHello parser of Fortra BoKS Manager’s boks_portmux daemon. The flaw allows any network host to send a malformed ClientHello that causes the daemon to crash. Because boks_portmux is usually restarted automatically, a single exploit only temporarily stops the service, but repeated attacks can keep it down, resulting in a denial‑of‑service that disrupts application functionality.

Fortra BoKS Manager is the impacted product. The advisory applies to all versions of the boks_server until the patched releases 8.1.0.24 and 9.0.0.7 become available. No other affected product versions are listed, so the scope is limited to the BoKS Manager software.

The CVSS score of 7.5 indicates a high likelihood of successful exploitation, and the EPSS score is currently unavailable. The vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed large‑scale exploitation yet. Based on the description, it is inferred that the attack can be carried out by any unauthenticated remote host that can reach boks_portmux, making it a straightforward denial‑of‑service attack that can be repeated until a mitigated state is achieved.