PInfo 0.6.9-5.1 contains a local buffer overflow that can be triggered by supplying an oversized argument to the -m parameter. The attacker crafts an input string consisting of 564 bytes of padding followed by a return address, thereby overwriting the instruction pointer and executing arbitrary shellcode. The vulnerability therefore allows an attacker with local user privileges to run code of their choice within the context of that user.

The vulnerability affects the PInfo utility, specifically the 0.6.9-5.1 release. Users of this version, followed by those who have not installed newer releases or the patched package from Debian or the upstream project, are impacted.

The CVSS community score of 8.6 indicates high severity, and the attack vector is local, requiring an attacker to be able to execute commands on the affected system. No EPSS score is supplied, and the issue is not listed in the CISA KEV catalog, but the nature of the overflow allows an attacker to gain arbitrary code execution with the privileges of the running user. As such, the risk is high for systems where PInfo is installed and the -m option is used.