The vulnerability in HMBRAND DBI affects versions prior to 1.650. It arises from an off-by-one out-of-bounds read in the preparse method when deleting an initial SQL comment line. This method is responsible for normalizing SQL statements and removing comments. The out-of-bounds read of one byte can cause faults in memory-hardened environments and unpredictable behavior related to newline characters in standard builds. The CVSS 3.1 base score is 9.1, indicating a critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and availability impact but no integrity impact. No official patch or remediation level is provided in the available data, and no known exploits are reported in the wild.

Successful exploitation can lead to application faults or crashes due to out-of-bounds memory reads. On memory-hardened builds, this results in faults, while on normal builds it causes nondeterministic behavior in newline retention. The vulnerability has a critical CVSS score of 9.1, indicating high impact on confidentiality and availability. There is no indication of integrity impact. No known exploits have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, avoid processing SQL statements starting with comments in affected DBI versions or consider applying custom input validation or sanitization to mitigate the risk.