A buffer overflow exists in the Hostname/IP field of NetSchedScan 1.0. When a user supplies an overly long string—specifically 388 bytes followed by an overwrite of the return pointer—the application crashes, resulting in a denial of service. The flaw permits a local attacker to trigger the crash through a crafted payload, compromising the availability of the service without affecting confidentiality or integrity.

The affected product is Foundstone NetSchedScan version 1.0, as identified by the CNA and represented in the advisory. No further versions are listed as affected, and only this product appears to be vulnerable.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score of less than 1 percent suggests low exploitation likelihood. The vulnerability is not catalogued in CISA's KEV list, implying it is not a known exploited vulnerability at this time. The attack vector is local: an attacker must have access to the system running NetSchedScan to supply the malicious input. Given the lack of publicly documented remote exploitation, the risk is primarily confined to environments where the application is exposed to untrusted local users.