The INDI (Instrument Neutral Distributed Interface) indiserver through version 2.2.4.2 has a stack buffer overflow vulnerability in MsgQueue.cpp. An attacker can send a single TCP packet on port 7624 containing malformed XML with mismatched tags whose names exceed 1024 bytes. This triggers an unbounded sprintf() write into a fixed 1024-byte stack buffer, leading to a crash of the daemon process. The vulnerability does not require authentication and results in denial of service by terminating the indiserver and disrupting all active sessions. The issue was fixed in commit 96bbd7f, but no official patch or advisory is currently linked.

Successful exploitation causes the indiserver daemon to crash, resulting in denial of service and disruption of all active client and driver sessions. There is no indication of code execution or data corruption beyond service termination. The vulnerability can be triggered remotely without authentication by sending a specially crafted TCP packet to port 7624.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability was fixed in commit 96bbd7f, so upgrading to a version including this commit or later is recommended once available. Until then, restricting network access to port 7624 or filtering malformed XML traffic may reduce exposure.