JAD 1.5.8e-1kali1 contains a stack‑based buffer overflow that lets an attacker supply an input string larger than 8,150 bytes. The overflow corrupts the return address on the stack, enabling the attacker to inject and execute arbitrary shellcode within the Java Decompiler process. This flaw, classified as CWE‑787, results in a complete loss of control over the application’s execution flow and introduces confidentiality, integrity, and availability risks.

The vulnerability affects Varaneckas JAD Java Decompiler versions 1.5.8e‑1kali1 and all earlier releases. Any system that runs these versions and accepts externally supplied input is susceptible to exploitation.

The CVSS score of 9.3 indicates a very high severity, and the absence of an EPSS score does not reduce the likelihood of attack because the flaw can be triggered by a simple oversized input. The vulnerability is not listed in the CISA KEV catalog, yet it remains capable of exploitation in the wild; attackers can deliver the malicious payload remotely by crafting a large string or file. Consequently, the threat is urgent and demands immediate action to mitigate the risk.