Technical impact
The vulnerability is a local buffer overflow triggered when the -m parameter of PInfo receives an input longer than permitted. The overflow allows the attacker to overwrite the instruction pointer with a crafted return address and inject shellcode, leading to arbitrary code execution with the privileges of the user running the program. This represents a CWE‑787 buffer overflow weakness.
Affected Systems
The vendor PInfo, version 0.6.9-5.1, is affected. Users installing this package—commonly found in Debian-based distributions—are vulnerable if they run the command with the -m option. No other versions or platforms are listed, so the issue appears confined to this specific release.
Risk and Exploitability
The CVSS score of 8.6 indicates high severity, while the EPSS score of less than 1% suggests exploitation is unlikely under current conditions. The vulnerability is not in the CISA KEV catalog. Attackers must be local to the system; they do not need external network access. If a malicious payload is supplied via the -m flag, the local user can gain control of the process and potentially elevate privileges on the host.
