Suricata, a network intrusion detection and prevention system, contains an out-of-bounds read vulnerability (CWE-125) in its SMTP MIME quoted-printable decoder located in src/util-decode-mime.c. The flaw arises when a quoted-printable escape sequence is split across traffic chunks and the subsequent chunk contains exactly one byte, leading the decoder to read one byte past the allocated heap buffer. This crafted SMTP traffic can trigger a crash of Suricata when the decode-quoted-printable MIME decoding feature is enabled. The vulnerability affects versions from 7.0.13 up to but not including 7.0.17 and has been resolved in version 7.0.17.

Successful exploitation of this vulnerability can cause Suricata to crash, resulting in a denial of service condition. The CVSS v3.1 base score is 8.2 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to confidentiality loss (low) and availability loss (high). There is no indication of code execution or integrity impact. No known exploits are reported in the wild.

Upgrade Suricata to version 7.0.17 or later, where this vulnerability is fixed. If upgrading immediately is not possible, consider disabling decode-quoted-printable MIME decoding for SMTP traffic as a temporary mitigation, if feasible. Patch status is confirmed fixed in 7.0.17.