The vulnerability is located in the vlib_worker_loop function of the libvlib.so library used by Dotouch XproUPF’s UPF Process component. A maliciously crafted input can trigger the loop into an inconsistent state, causing the entire process to halt and resulting in a denial of service. The weakness corresponds to CWE-404 "Removal of Unnecessary Functionality," indicating supervisory calls are improperly handled.

Dotouch XproUPF version 2.0.0-release-088aa7c4, specifically the UPF Process module located at /usr/xpro/upf/tools/libs/libvlib.so. No other vendors or product versions are listed as affected in the CNA data.

The CVSS score of 5.1 classifies the flaw as moderate severity. EPSS is not available, so the current exploitation probability is unknown. The flaw is not listed in the CISA KEV catalog, suggesting no confirmed exploitation in the wild. The exact attack vector is not fully detailed, but manipulation of the UPF Process input implies that a local or privileged attacker could trigger the denial of service. Until a vendor patch is released, the risk remains that an attacker could disrupt service availability.