BusyBox TLS’s get_client_hello function reads one byte beyond the end of the input buffer when parsing a truncated ClientHello message, a flaw classified as CWE-125: Out‑of‑Bounds Read. This out‑of‑bounds read can expose sensitive data from adjacent memory, potentially allowing an attacker to obtain confidential information. The vulnerability is a read‑only issue and does not provide a pathway to remote code execution, but it can lead to information disclosure if exploited.

The flaw is present in the BusyBox implementation shipped with Red Hat Hardened Images (Hummingbird 1). Systems that use BusyBox’s ssl_server component in a production environment are affected. No other vendor or product versions were listed as vulnerable in the CNA data.

The CVSS score of 5.3 indicates a moderate severity. EPSS is not available, so the current assessment of exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote TLS client that sends a malformed or truncated ClientHello to a BusyBox ssl_server instance. The flaw leads to an information‑disclosure type of impact rather than a denial of service or code execution.