The vulnerability is a local buffer overflow triggered when calling iSelect with an oversized value for the –k or --key option. The overflow occurs in a 1024‑byte stack buffer and an attacker can supply a crafted argument containing a NOP sled, shellcode, and a return address, allowing them to execute arbitrary code with the privileges of the user running iSelect. The flaw is documented as a stack‑based buffer overflow.

The affected product is iSelect from the iselect vendor, specifically version 1.4.0‑2+b1.

With a CVSS score of 8.6, the vulnerability is considered high severity. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, indicating that the exploit is not widely known or actively used in the wild. However, the local nature of the attack means any user with access to the target machine can potentially trigger the overflow and gain code execution. System administrators should treat this as a high risk and prioritize remediation.