A critical out-of-bounds read vulnerability in Suricata versions 7.0.13 through 7.0.16 can lead to service disruption via crafted SMTP traffic.

This vulnerability is an out-of-bounds read (CWE-125) located in the src/util-decode-mime.c file. An unauthenticated remote attacker can trigger this flaw by sending specifically crafted SMTP traffic that causes the decoder to read past a heap buffer when quoted-printable MIME decoding is enabled.

The primary risk associated with this vulnerability is the potential for a denial of service (DoS) against the network security monitoring infrastructure. Because Suricata acts as an intrusion detection and prevention system, a crash could leave the network environment blind to malicious activity, thereby increasing the risk of unmonitored security breaches. The CVSS score of 8.2 reflects the high availability impact and the ease of exploitation over the network without requiring authentication.

Immediate Action: Update Suricata to version 7.0.17 or later to incorporate the vendor-provided patch.

Proactive Monitoring: Monitor system logs for unexpected process termination or crashes of the Suricata service, particularly those occurring during high volumes of SMTP traffic.

Compensating Controls: If immediate patching is not feasible, disable the decode-quoted-printable MIME decoding feature in the Suricata configuration to prevent the trigger condition.

Public Exploit Available: Unknown

Given the role of Suricata in organizational perimeter defense, this vulnerability presents a significant risk to network visibility. Security teams should prioritize upgrading to version 7.0.17 immediately to eliminate the crash condition and ensure the continued stability of their intrusion detection capabilities.