A reachable assertion in YARA 4.5.8 can be triggered by loading specially crafted compiled rule files in the .yrc format. When an attacker supplies a file with an invalid arena configuration (num_buffers=0), the function yr_arena_get_ptr() encounters an assertion failure that causes the YARA process to terminate. The primary effect is an application crash, which results in a denial of service rather than remote code execution or data exposure.

The vulnerability appears in the open‑source YARA engine version 4.5.8, maintained by the VirusTotal community. No other product variants or higher versions are listed as affected. Users running this specific release are at risk when they load untrusted compiled rule files.

Based on the description, it is inferred that the attack vector is local; an adversary must provide a malicious .yrc file to an instance of YARA running under the attacker's user context or a privileged user that can supply the file. No remote exploitation path is documented. The EPSS score is < 1% and the vulnerability is not listed in CISA KEV, indicating a low likelihood of exploitation. The CVSS score of 5.5 reflects a moderate impact, with the functional effect being a denial of service via application termination.