The vulnerability resides in the handling of the gamma parameter within the Multi Emulator Super System. An attacker who can supply an oversized gamma value locally can trigger a stack buffer overflow, which can lead to either a denial of service by crashing the application or to arbitrary code execution if the attacker supplies a crafted return address. The weakness corresponds to CWE-787, reflecting an improper handling of untrusted input that exceeds buffer bounds.

The affected product is the Multi Emulator Super System, version 0.154-3.1, distributed by mamedev:Mess Emulator. No other versions or vendors are listed in the available data.

This flaw is rated high on the CVSS scale with a score of 8.6, indicating a significant impact for local attackers. The EPSS score is not provided, and the vulnerability is not included in CISA’s KEV catalog. Since the flaw requires local privileged input to trigger the overflow, the attack vector is local. No remote exploitation is documented, but the use of an oversized gamma parameter directly could allow an attacker to crash the process or gain code execution on the host system.