The vulnerability is a stack‐based buffer overflow in JAD Java Decompiler 1.5.8e‑1kali1 and earlier releases. Malicious input that exceeds the defined buffer size triggers the overflow, allowing direct overwrite of the return address. An attacker can exploit this through the command‑line interface, inject arbitrary code, and spawn a shell, resulting in complete compromise of the host on which JAD is executed. This weakness falls under CWE‑787 and carries critical severity.

Varaneckas’ JAD Java Decompiler, versions 1.5.8e‑1kali1 and all prior versions are vulnerable. The product is used for reverse engineering Java bytecode, and the flaw is located in the command‑line parsing logic. Any environment that uses these releases for decompilation tasks is at risk if the software is run by attackers or by compromised processes.

The CVSS base score is 9.3, indicating a high‑severity remote code execution flaw. The EPSS score is below 1 %, suggesting that publicly observed exploitation is rare at present, though the risk remains if an attacker can supply crafted input. The vulnerability is not listed in the CISA KEV catalog, but if an attacker can invoke Jad locally or through a compromised build pipeline, they can achieve arbitrary code execution with minimal prerequisites. The attack does not require elevated privileges, but higher privileges will increase damage potential. Organizations should consider the flaw as a critical exposure that warrants immediate mitigation.