Voicesentinel
Monthly
Concurrent transcript writes and hourly retention cleanup in the VoiceSentinel Processor's opt-in report buffer (versions 2.2.1 through 3.3.0) can lose, duplicate or corrupt transcript records and silently defeat retention pruning, so the buffer stops shrinking and grows until the processor host's disk fills and the machine or co-located services crash. The flaw is a check-then-act race: cleanup reads and rewrites transcripts.jsonl in place while appends land from a separate thread, and multiple _processing_worker tasks make the collision reachable during normal operation, especially with processing.worker_count of 2 or more or a shared public-pool deployment using one server_key. Exploitation is gated behind report_buffer.enabled being set to true (off by default), the outcome is timing- and load-dependent, and no public exploit code or active exploitation was identified at time of analysis; the vendor-released patch is 3.3.1.
Concurrent transcript writes and hourly retention cleanup in the VoiceSentinel Processor's opt-in report buffer (versions 2.2.1 through 3.3.0) can lose, duplicate or corrupt transcript records and silently defeat retention pruning, so the buffer stops shrinking and grows until the processor host's disk fills and the machine or co-located services crash. The flaw is a check-then-act race: cleanup reads and rewrites transcripts.jsonl in place while appends land from a separate thread, and multiple _processing_worker tasks make the collision reachable during normal operation, especially with processing.worker_count of 2 or more or a shared public-pool deployment using one server_key. Exploitation is gated behind report_buffer.enabled being set to true (off by default), the outcome is timing- and load-dependent, and no public exploit code or active exploitation was identified at time of analysis; the vendor-released patch is 3.3.1.