The DM_OP handling code does not validate that the caller has supplied the necessary number of buffers for the operation. This assumption leads to possible access of uninitialized stack memory (stack rubble), as structures may not be properly initialized. This can result in unintended information disclosure or integrity issues. The vulnerability is identified as CVE-2026-62433 and has a CVSS 3.1 base score vector indicating network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality, integrity, and availability at a low level each.

Exploitation of this vulnerability could allow an attacker to cause the affected software to access uninitialized stack memory, potentially leading to information disclosure, data corruption, or denial of service. The CVSS vector indicates low complexity and no required privileges, increasing the risk of remote exploitation. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. No specific mitigations are provided in the available data.