The vulnerability is a local buffer overflow in the username handling routine of EKG Gadu 1.9, triggered by passing an overly long username string to the strlcpy function. When the string exceeds 258 bytes, the function overflows the buffer, overwriting the instruction pointer and enabling an attacker with local access to execute injected shellcode under the privileges of the victim user.

The product affected is EKG Gadu version 1.9 (build 1.9~pre+r2855-3+b1) from vendor EKG:EKG Gadu.

With a CVSS score of 8.6, this issue is considered high severity. The exploit requires local user access and does not appear dependent on any network exposure; however, any local user can trigger arbitrary code execution. The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, indicating a moderate potential for exploitation but no known widespread attacks.