This vulnerability involves out-of-bounds memory writes and reads in the --showSCSIDefects functionality of Seagate's openSeaChest tool (v25.05.3 and earlier). It is triggered by processing defect lists that are excessively large, either from a drive with many defects or a maliciously crafted SCSI device that returns an abnormal defect response length. The issue can cause memory corruption due to writing outside allocated buffers. The CVSS 4.0 base score is 1.8, reflecting low impact and requiring high privileges and local access for exploitation. No remediation level or patch information is currently provided by the vendor.

The vulnerability allows out-of-bounds memory writes and reads, which could potentially lead to memory corruption. However, the low CVSS score and requirement for high privileges and local access limit the impact. There are no reports of exploitation in the wild. The impact is primarily on the stability and integrity of the openSeaChest tool when handling large or malicious defect lists.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when using the --showSCSIDefects feature with untrusted or very large defect lists. Restricting access to the tool to trusted users with appropriate privileges may reduce risk.