OpenClaw versions up to 2026.4.7 contain multiple code paths where base64 decoding operations lack proper pre-allocation size checks. This flaw could lead to allocations exceeding intended decoded size limits. The issue affects local user-controlled instances of OpenClaw and does not involve multi-tenant service boundaries. The vulnerability has been fixed in version 2026.4.8.