The vulnerability exists in the PathAttributeAigp.DecodeFromBytes function of the AIGP Attribute Parser in osrg GoBGP up to version 4.3.0. A crafted input can cause a buffer overflow, which may be exploited remotely without authentication or user interaction. The vendor fixed this issue in version 4.4.0 with a specific patch. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to low impact on confidentiality, integrity, and availability.

Successful exploitation of this buffer overflow could lead to memory corruption, potentially allowing an attacker to disrupt the normal operation of the GoBGP service or cause denial of service. The CVSS score of 6.9 reflects a medium severity impact with limited confidentiality, integrity, and availability impact. No evidence of active exploitation in the wild has been reported.

Upgrade affected GoBGP installations to version 4.4.0 or later, which contains the official patch (commit 51ad1ada06cb41ce47b7066799981816f50b7ced) addressing this buffer overflow vulnerability. Since this is a self-hosted software component, users must apply the update manually. Patch status is confirmed by the vendor's versioning and patch commit. No additional mitigations are specified.