The vulnerability is a heap out-of-bounds write in libconfini 1.16.4 caused by an off-by-one error in the bundled load_ini_buffer.h utility. The strip_ini_cache() function writes a NUL terminator at ini_source[ini_length] while the buffer is only ini_length bytes long, allowing deterministic corruption of adjacent heap memory whenever any non-empty INI file is parsed. This results in a denial of service because the corrupted memory can crash the application or lead to undefined behavior.

The affected product is the libconfini library version 1.16.4. Any application that incorporates this library and relies on the bundled load_ini_buffer.h implementation is susceptible. No specific vendor or product names were supplied, so the issue applies broadly to all users of that library version.

The attack vector is inferred to involve feeding a crafted INI file to the vulnerable application, either locally or over a network, if the application opens configuration files or accepts INI input from an untrusted source. No authentication or privilege escalation is required; the condition triggers immediately upon parsing a non-empty INI file. With an EPSS score of less than 1% and no KEV listing, the public exploit probability is low, but the deterministic nature of the corruption and lack of defensive checks indicate a high risk for denial of service if the library remains unpatched.