Boxoft wav-wma Converter version 1.0 contains a local buffer overflow in its structured exception handling (SEH) logic. A malicious WAV file with excessive data can overwrite the SEH chain and redirect execution to a Return-Oriented Programming chain created by an attacker, resulting in arbitrary code execution with the privileges of the user running the converter. The flaw corresponds to CWE-787, a classic buffer overrun that directly leads to code execution.

The affected product is Boxoft’s WAV to WMA Converter, version 1.0, which runs on Windows operating systems. No other versions or products were mentioned in the advisory; the exploitation relies on the Windows SEH mechanism.

The CVSS score of 8.6 indicates high severity, and the vulnerability is not listed in the KEV catalog. EPSS information was not published. The exploit requires local file access or the ability to influence which file the converter opens; the description implies that a specially crafted WAV file can trigger the buffer overflow when opened. This inference is based on the stated need to supply such a file and is not explicitly confirmed in the advisory. If an attacker can supply or persuade a user to open a malicious file, the vulnerability can be exploited without authentication.