HNB Organizer 1.9.18-10 contains a local buffer overflow that is triggered by the -rc command‑line parameter. When an attacker supplies an argument longer than 108 bytes, the string is copied into a fixed‑size buffer on the stack, leading to an overwrite of the return address. This allows the attacker to place shellcode and a forged address on the stack, so the program can be redirected to execute arbitrary code. The vulnerability can be leveraged by any user with local access to the system, giving the attacker control over the application_process and potentially the underlying operating system depending on privileges.

The issue affects the HNB Organizer software, provided by HNB, specifically version 1.9.18-10 of the Hierarchical Notebook project. No other product or version information is listed in the CVE record.

The CVSS score of 8.6 indicates a high severity, but the EPSS score of less than 1 percent suggests that exploitation is currently rare and there are no active widespread attacks documented. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local access to the target machine, so it is a local attack vector. Because it is a stack buffer overflow with controllable return address, attackers can achieve remote code execution if they can supply a crafted input through the command line.