CVE-2026-40454 is an out-of-bounds read vulnerability (CWE-125) caused by improper input validation (CWE-20) in the Apache IoTDB C++ client TsBlock deserializer. When the client processes malformed data from the server, it may read memory beyond the intended buffer, leading to a crash of the client process. This affects Apache IoTDB C++ client versions >=1.3.5 <1.3.8 and >=2.0.5 <2.0.10. The vulnerability has a CVSS 3.1 base score of 7.5 (high severity) with network attack vector, low attack complexity, no privileges or user interaction required, and impacts availability only. Users are advised to upgrade to version 2.0.10 where the issue is fixed.

Exploitation of this vulnerability results in a denial of service by crashing the client process due to out-of-bounds memory reads when handling malformed server data. There is no indication of confidentiality or integrity impact. The vulnerability can be triggered remotely without authentication or user interaction.

Upgrade affected Apache IoTDB C++ client versions to 2.0.10 or later, which contains the fix for this vulnerability. Patch status is confirmed by the vendor's recommendation to upgrade to 2.0.10. No other mitigations are indicated.