A vulnerability in the tftp-hpa client (Trivial File Transfer Protocol) allows a remote unauthenticated attacker to cause a denial of service by triggering out-of-bounds read/write operations. This occurs when the in.tftpd remap engine processes an inverse remap rule that aborts with a non-empty custom error message, passing invalid match offsets to the genmatchstring() function, leading to a crash of the daemon.