This vulnerability arises from an out-of-bounds access in the claircore apk package scanner used by Red Hat Advanced Cluster Security 4. When processing malformed package-database data within a container layer, the scanner may panic. If this panic is not recovered, it causes the Clair indexer process to crash, leading to a denial of service condition. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, requiring low privileges and no user interaction, and impacting availability only. No vendor advisory indicates an available patch or workaround as of the published date.

Successful exploitation causes the Clair indexer process to crash, resulting in denial of service. There is no impact on confidentiality or integrity reported. The vulnerability could disrupt container image scanning operations within Red Hat Advanced Cluster Security 4 environments.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-16254 for current remediation guidance. Until a fix is available, consider monitoring the Clair indexer process for crashes and implement recovery mechanisms to handle scanner panics if possible.