The vulnerability is a local buffer overflow triggered when the -m parameter of PInfo receives an input longer than permitted. The overflow allows the attacker to overwrite the instruction pointer with a crafted return address and inject shellcode, leading to arbitrary code execution with the privileges of the user running the program. This represents a CWE‑787 buffer overflow weakness.

The vendor PInfo, version 0.6.9-5.1, is affected. Users installing this package—commonly found in Debian-based distributions—are vulnerable if they run the command with the -m option. No other versions or platforms are listed, so the issue appears confined to this specific release.

The CVSS score of 8.6 indicates high severity, while the EPSS score of less than 1% suggests exploitation is unlikely under current conditions. The vulnerability is not in the CISA KEV catalog. Attackers must be local to the system; they do not need external network access. If a malicious payload is supplied via the -m flag, the local user can gain control of the process and potentially elevate privileges on the host.