A heap-based buffer overflow flaw exists in HiRDB Server that can be triggered when the application processes untrusted data. If successfully exploited, an attacker could execute arbitrary code on the affected system, gaining full control and threatening confidentiality, integrity, and availability. The vulnerability is identified as CWE-122 and poses a high level of risk to any application that relies on HiRDB for data storage or retrieval.

The flaw affects Hitachi HiRDB Server Version 10 for releases from 10‑00 up to but not including 10‑12‑01, Version 9 for releases from 09‑00 through 09‑66‑22, Version 9(32) for releases from 09‑02 through 09‑66‑22, and both the standard and Additional Function variants of those releases. Systems running any of these product lines with the specified version ranges are vulnerable if no patch is applied.

The CVSS score of 9.8 indicates very high severity and a high likelihood of successful exploitation. The EPSS score is not available, but the lack of listing in CISA KEV does not reduce the risk; attackers can still target the flaw. The likely attack vector is remote exploitation through network interfaces that accept untrusted input, inferred from the heap nature of the overflow. Exploitation would typically require the attacker to send specially crafted data to the server, which can then trigger memory corruption and code execution.