CVE-2023-28638

CVE-2023-28638 is a buffer overrun vulnerability in Snappier 1.1.0, a C# implementation of the Snappy compression algorithm. This flaw arises from a specific interaction between byte references and the .NET garbage collector during compaction, where brief invalid byte reference states can lead to incorrect buffer range checks. The vulnerability has a CVSS score of 5.9 (Medium), indicating a network-based attack with high attack complexity, requiring precise timing for a successful denial-of-service impact. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE. Users are advised to upgrade to Snappier 1.1.1 or implement buffer pinning as a partial mitigation.