Flat Assembler version 1.71.21 contains a stack‑based buffer overflow that allows a local attacker to supply input larger than 5895 bytes, overwriting the instruction pointer on the stack and enabling arbitrary code execution via return‑oriented programming chains. This flaw is a classic buffer overrun (CWE‑787) and can lead to denial of service or the execution of arbitrary shell commands on the machine where Flat Assembler runs.

The affected product is Flat Assembler 1.71.21 from Flatassembler. No other affected versions are reported in the data.

The CVSS score of 8.6 signals a high severity vulnerability, but the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers would need local access to the target machine to provide malicious assembly input, so the primary attack vector is local. The exploit requires the attacker to run or influence Flat Assembler in a way that allows oversized input to be processed.