This vulnerability in Progress MOVEit Transfer's Custom Reports modules results from missing release of memory after its effective lifetime (CWE-401). The affected versions are 2025.0.0, 2025.1.0, and 2026.0.0. The CVSS 3.1 base score is 7.5, reflecting a network attack vector with low complexity, no privileges or user interaction required, and impacts availability only. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported as of the publication date.

The vulnerability can lead to denial of service conditions by exhausting system memory due to unreleased memory allocations. It does not affect confidentiality or integrity of data. Systems running the affected versions may experience degraded performance or crashes if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor system resource usage closely and consider limiting exposure of the affected modules to untrusted networks. Avoid deploying affected versions in critical environments without additional safeguards.