The vulnerability is a stack‑based buffer overflow in yTree 1.94‑1.1. A local attacker can supply an overly long command‑line argument that overwrites the return address on the stack and injects shellcode, allowing arbitrary code to execute within the application's context.

The affected product is yTree from the Werner vendor. The vulnerability applies to versions 1.94 through 1.1 as noted. There is no indication that later releases are affected or that other products share this flaw.

With a CVSS base score of 8.6 the vulnerability is considered high severity. No EPSS score is available and the issue is not listed in the CISA KEV catalog, suggesting there is no widespread exploitation yet. However, because the flaw requires local execution rights, any local user with access to run yTree could abuse it to gain code execution, which poses a significant risk especially if the program runs with elevated privileges.